General

  • Target

    31970f406f7248e90d19b66c3c3560fc7d94d952fd9b64ad305962b010d78c0eN

  • Size

    205KB

  • Sample

    241110-s27nzazbrr

  • MD5

    c3f7a8784ef1e8bd2c439ac4dc0d4e40

  • SHA1

    6169d1922794320f698fc28da46e3fab14b35432

  • SHA256

    31970f406f7248e90d19b66c3c3560fc7d94d952fd9b64ad305962b010d78c0e

  • SHA512

    321b94042c413e4fe58b72c33c77f73f695545c5ced06691025bf02866efc2a98d3d42880be7744ef15625f9bfd05cde2eee924271619a4c640a46009e0efdcf

  • SSDEEP

    6144:d6FAphOHrp/Uej8lfxjtGyZ6YugQdjGG1wsKm6eBgdQbz:d6FApIHr1Us8lfxpGyXu1jGG1wsGeBg8

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      31970f406f7248e90d19b66c3c3560fc7d94d952fd9b64ad305962b010d78c0eN

    • Size

      205KB

    • MD5

      c3f7a8784ef1e8bd2c439ac4dc0d4e40

    • SHA1

      6169d1922794320f698fc28da46e3fab14b35432

    • SHA256

      31970f406f7248e90d19b66c3c3560fc7d94d952fd9b64ad305962b010d78c0e

    • SHA512

      321b94042c413e4fe58b72c33c77f73f695545c5ced06691025bf02866efc2a98d3d42880be7744ef15625f9bfd05cde2eee924271619a4c640a46009e0efdcf

    • SSDEEP

      6144:d6FAphOHrp/Uej8lfxjtGyZ6YugQdjGG1wsKm6eBgdQbz:d6FApIHr1Us8lfxpGyXu1jGG1wsGeBg8

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks