General

  • Target

    388dc61855fe3ed93f1ad6d8e712a03f7ac008f5ad3709a90d524b3a93af70dbN

  • Size

    115KB

  • Sample

    241112-nlqcjavleq

  • MD5

    cadbf36a39f1375c15ac1b8274065d30

  • SHA1

    54021a89835f19bb2460fb182e284ea8b5f8b22b

  • SHA256

    388dc61855fe3ed93f1ad6d8e712a03f7ac008f5ad3709a90d524b3a93af70db

  • SHA512

    246411add23151838a360d4929b626136dd28bb64fbcb4a3ea0b3655719c151b6cd6e0581bfd2abe8cbf9420091f3726c12c70d9a454a8d9ff57d060666d5b62

  • SSDEEP

    3072:6RZBOqwz5R6BKMoLHXUFW2VTbWymWU6SMQehalNgFuk0:6RdwWB+LHXUf6ymWU5MClN5

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      388dc61855fe3ed93f1ad6d8e712a03f7ac008f5ad3709a90d524b3a93af70dbN

    • Size

      115KB

    • MD5

      cadbf36a39f1375c15ac1b8274065d30

    • SHA1

      54021a89835f19bb2460fb182e284ea8b5f8b22b

    • SHA256

      388dc61855fe3ed93f1ad6d8e712a03f7ac008f5ad3709a90d524b3a93af70db

    • SHA512

      246411add23151838a360d4929b626136dd28bb64fbcb4a3ea0b3655719c151b6cd6e0581bfd2abe8cbf9420091f3726c12c70d9a454a8d9ff57d060666d5b62

    • SSDEEP

      3072:6RZBOqwz5R6BKMoLHXUFW2VTbWymWU6SMQehalNgFuk0:6RdwWB+LHXUf6ymWU5MClN5

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks