General

  • Target

    77f6b0d3ab866837edea4dff213c4a0975b91ccbc5e82dc76cc8a03a28bb1c95N

  • Size

    264KB

  • Sample

    241110-rxqdfsyfrb

  • MD5

    d4cdd565eaaba062567aaa4844bcf230

  • SHA1

    dd4490744ed3fa3226b39099de99e96c87b9867e

  • SHA256

    77f6b0d3ab866837edea4dff213c4a0975b91ccbc5e82dc76cc8a03a28bb1c95

  • SHA512

    4570385cdeeae89065b8cebfcbc24a0addf86fb1c77c1d344c221dac2f69fe49962ce5d69c08460b27d1df7095466cc58cdd9a36236b157e2c08533907b25681

  • SSDEEP

    6144:cSovxMBqbdk+xBCkBXpui6yYPaIGckVx3cGHGcXW3w4LOypui6yYPaIGckv:IxM8ndpV6yYP0K3vFpV6yYPo

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      77f6b0d3ab866837edea4dff213c4a0975b91ccbc5e82dc76cc8a03a28bb1c95N

    • Size

      264KB

    • MD5

      d4cdd565eaaba062567aaa4844bcf230

    • SHA1

      dd4490744ed3fa3226b39099de99e96c87b9867e

    • SHA256

      77f6b0d3ab866837edea4dff213c4a0975b91ccbc5e82dc76cc8a03a28bb1c95

    • SHA512

      4570385cdeeae89065b8cebfcbc24a0addf86fb1c77c1d344c221dac2f69fe49962ce5d69c08460b27d1df7095466cc58cdd9a36236b157e2c08533907b25681

    • SSDEEP

      6144:cSovxMBqbdk+xBCkBXpui6yYPaIGckVx3cGHGcXW3w4LOypui6yYPaIGckv:IxM8ndpV6yYP0K3vFpV6yYPo

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks