General

  • Target

    32eefc6c92eeba66c4e723c435e9b1cd5904a72b8be84fdba0bbda285e5de74cN.exe

  • Size

    512KB

  • Sample

    241112-n7w27sscrq

  • MD5

    b919fe17be1b3cc6d060bbcd49aa54da

  • SHA1

    a63661d5e379873399ed12937eab4839fec49e82

  • SHA256

    de6eb1534b73f28f6a52b6ff9e657596d8c88e154bb318deaa31328011ca6e6c

  • SHA512

    a8d0a76d5622c600ad20fb700a64a07cb901400f82378a2236c8fda838341acd1f3c224d6304938f03892e31b27da6d19a28cbc0ebea6db44a88e3e5d12ce767

  • SSDEEP

    12288:h+yQmGyXu1jGG1wsGeBgRTGAzciETdqvZNemWrsiLk6mqgSgk:hTGyXsGG1wsLUT3Iip2

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      32eefc6c92eeba66c4e723c435e9b1cd5904a72b8be84fdba0bbda285e5de74cN.exe

    • Size

      512KB

    • MD5

      b919fe17be1b3cc6d060bbcd49aa54da

    • SHA1

      a63661d5e379873399ed12937eab4839fec49e82

    • SHA256

      de6eb1534b73f28f6a52b6ff9e657596d8c88e154bb318deaa31328011ca6e6c

    • SHA512

      a8d0a76d5622c600ad20fb700a64a07cb901400f82378a2236c8fda838341acd1f3c224d6304938f03892e31b27da6d19a28cbc0ebea6db44a88e3e5d12ce767

    • SSDEEP

      12288:h+yQmGyXu1jGG1wsGeBgRTGAzciETdqvZNemWrsiLk6mqgSgk:hTGyXsGG1wsLUT3Iip2

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks