General

  • Target

    e4d678c897104196e0f144d5b6a9280a54f2013f27a5250c62376be48e23d0ebN

  • Size

    97KB

  • Sample

    241111-p8aq2azarl

  • MD5

    ed416cb65f6c874c78b513f4c565a630

  • SHA1

    92421916421c13aaa88f9183ed67a7bc7782b74c

  • SHA256

    e4d678c897104196e0f144d5b6a9280a54f2013f27a5250c62376be48e23d0eb

  • SHA512

    70d5deca59ba3c0acd21c5d9d4666dc1c4ce0e3f8f0039b7eeb45f01951b588820012f29b5d96c48afbf2609855ceaf1c9db8de5ea1b3a0f3bd67221b3f5cc06

  • SSDEEP

    3072:gIaK0AnzPsSrN+LbegDaF++So3m/nJXeK6:ZqSZ5UKe9eX

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e4d678c897104196e0f144d5b6a9280a54f2013f27a5250c62376be48e23d0ebN

    • Size

      97KB

    • MD5

      ed416cb65f6c874c78b513f4c565a630

    • SHA1

      92421916421c13aaa88f9183ed67a7bc7782b74c

    • SHA256

      e4d678c897104196e0f144d5b6a9280a54f2013f27a5250c62376be48e23d0eb

    • SHA512

      70d5deca59ba3c0acd21c5d9d4666dc1c4ce0e3f8f0039b7eeb45f01951b588820012f29b5d96c48afbf2609855ceaf1c9db8de5ea1b3a0f3bd67221b3f5cc06

    • SSDEEP

      3072:gIaK0AnzPsSrN+LbegDaF++So3m/nJXeK6:ZqSZ5UKe9eX

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks