General

  • Target

    91d0dbb5e36e05b09f730a3805f0810c301cbd05eb88201c893b0e4d873d20f0N

  • Size

    192KB

  • Sample

    241110-ww233ssekg

  • MD5

    fa0788a18520be0ef7786357fbb8e060

  • SHA1

    e5766d094f9acb1b295780075ca17f9183fb7f94

  • SHA256

    91d0dbb5e36e05b09f730a3805f0810c301cbd05eb88201c893b0e4d873d20f0

  • SHA512

    c2178535bf76e91a68d3b17ade142ff11920a87ec51c6d29b5e248fddae8e03cc696172f2724a262cb374fa192b6b03455373722fa541fb704c04208d5e42501

  • SSDEEP

    3072:z3owRaaIdJyday/LvG8+W0LX8outkTy27zU:z4wZILcZT70D8oSkTl7zU

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      91d0dbb5e36e05b09f730a3805f0810c301cbd05eb88201c893b0e4d873d20f0N

    • Size

      192KB

    • MD5

      fa0788a18520be0ef7786357fbb8e060

    • SHA1

      e5766d094f9acb1b295780075ca17f9183fb7f94

    • SHA256

      91d0dbb5e36e05b09f730a3805f0810c301cbd05eb88201c893b0e4d873d20f0

    • SHA512

      c2178535bf76e91a68d3b17ade142ff11920a87ec51c6d29b5e248fddae8e03cc696172f2724a262cb374fa192b6b03455373722fa541fb704c04208d5e42501

    • SSDEEP

      3072:z3owRaaIdJyday/LvG8+W0LX8outkTy27zU:z4wZILcZT70D8oSkTl7zU

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks