General

  • Target

    79658748e1f79b6bf8332af3d9f1fda5f3d83303db79e3a30976454ad744de1b.exe

  • Size

    224KB

  • Sample

    241111-p3cy7ssqbm

  • MD5

    f7a6385a5292a86ac1cb27e9f48d50a9

  • SHA1

    34c76e2079808aea968834560fc0ca12d5f0b5bd

  • SHA256

    79658748e1f79b6bf8332af3d9f1fda5f3d83303db79e3a30976454ad744de1b

  • SHA512

    3d358a0e74542345d081d1f907ebfaf783cc3b1e0e6bdd8e6785621dd8f110cddcd86a0b962940322ea2c78f9e6f57a1460cd5da38566a5193ec185b92cc113f

  • SSDEEP

    3072:3mUVeYhmqxG0rEiIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgb:2UVlmqkYEa4s5tTDUZNSN58VU5tTt5

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      79658748e1f79b6bf8332af3d9f1fda5f3d83303db79e3a30976454ad744de1b.exe

    • Size

      224KB

    • MD5

      f7a6385a5292a86ac1cb27e9f48d50a9

    • SHA1

      34c76e2079808aea968834560fc0ca12d5f0b5bd

    • SHA256

      79658748e1f79b6bf8332af3d9f1fda5f3d83303db79e3a30976454ad744de1b

    • SHA512

      3d358a0e74542345d081d1f907ebfaf783cc3b1e0e6bdd8e6785621dd8f110cddcd86a0b962940322ea2c78f9e6f57a1460cd5da38566a5193ec185b92cc113f

    • SSDEEP

      3072:3mUVeYhmqxG0rEiIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgb:2UVlmqkYEa4s5tTDUZNSN58VU5tTt5

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks