General

  • Target

    bf18859c5b6b421012ef55bcca3a0e015692f8dd5c2f63b5bb7226578b3d05b9N

  • Size

    136KB

  • Sample

    241110-qs8tka1kan

  • MD5

    41342aecc0108a3c4dab20ba7eff8440

  • SHA1

    e8ef41b668d76d83ae4f3520621fc145702b2b5e

  • SHA256

    bf18859c5b6b421012ef55bcca3a0e015692f8dd5c2f63b5bb7226578b3d05b9

  • SHA512

    1d7a583e7991f00631ce3a3e500108f7fef5a8826a0da61c3490d0a20d9c0fa4bd9a0fb74984bf153dc3aebea3665202ebe5c53b935ba307ed7d64a8ac919c67

  • SSDEEP

    1536:h4ZiyUxmS+00r6dPf8MZ7RrGu3IYcOY0M+SwUfmk26T4/jz0cZ44mjD9r823FQ7N:hNZb+OdPf8W7lIuSn86T4si/mjRrz3OT

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bf18859c5b6b421012ef55bcca3a0e015692f8dd5c2f63b5bb7226578b3d05b9N

    • Size

      136KB

    • MD5

      41342aecc0108a3c4dab20ba7eff8440

    • SHA1

      e8ef41b668d76d83ae4f3520621fc145702b2b5e

    • SHA256

      bf18859c5b6b421012ef55bcca3a0e015692f8dd5c2f63b5bb7226578b3d05b9

    • SHA512

      1d7a583e7991f00631ce3a3e500108f7fef5a8826a0da61c3490d0a20d9c0fa4bd9a0fb74984bf153dc3aebea3665202ebe5c53b935ba307ed7d64a8ac919c67

    • SSDEEP

      1536:h4ZiyUxmS+00r6dPf8MZ7RrGu3IYcOY0M+SwUfmk26T4/jz0cZ44mjD9r823FQ7N:hNZb+OdPf8W7lIuSn86T4si/mjRrz3OT

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks