General

  • Target

    5fb91f467cd77b030d9e7330b69b5fa7bb8288f6a1321be936f8fac57528b604N

  • Size

    97KB

  • Sample

    241110-w6bzms1rdx

  • MD5

    6bea1f135ed6420c84100388cc3892a0

  • SHA1

    dd41597d217c62005ed2c0f617fa7d87339fab33

  • SHA256

    5fb91f467cd77b030d9e7330b69b5fa7bb8288f6a1321be936f8fac57528b604

  • SHA512

    6d178cfedd7650b62f96b56451b81ae718ff194e90b056dc61e24e7911cc6de07f20159d46d922ef31c8257e9eac8acec283c7881bfe1c4da2fd0587afc754a2

  • SSDEEP

    1536:ZJJA4A0w4qlveIIIyOJULCmGYLBrXUwXfzwE57pvJXeYZ6:P/IsB/Pzwm7pJXeK6

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      5fb91f467cd77b030d9e7330b69b5fa7bb8288f6a1321be936f8fac57528b604N

    • Size

      97KB

    • MD5

      6bea1f135ed6420c84100388cc3892a0

    • SHA1

      dd41597d217c62005ed2c0f617fa7d87339fab33

    • SHA256

      5fb91f467cd77b030d9e7330b69b5fa7bb8288f6a1321be936f8fac57528b604

    • SHA512

      6d178cfedd7650b62f96b56451b81ae718ff194e90b056dc61e24e7911cc6de07f20159d46d922ef31c8257e9eac8acec283c7881bfe1c4da2fd0587afc754a2

    • SSDEEP

      1536:ZJJA4A0w4qlveIIIyOJULCmGYLBrXUwXfzwE57pvJXeYZ6:P/IsB/Pzwm7pJXeK6

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks