General

  • Target

    6cb11d6fcd77aa899f298260853f5878939d3f6e20611ef6c49f655e45b486e9.exe

  • Size

    161KB

  • Sample

    241112-pkw95asfjl

  • MD5

    cd121e15fc93045676302de70d97002a

  • SHA1

    aa8ef03f60fee04376b957c757dd7eba3030d2c5

  • SHA256

    6cb11d6fcd77aa899f298260853f5878939d3f6e20611ef6c49f655e45b486e9

  • SHA512

    91f4c302f6678bd05bd6150e8a530316fdc8e001c796338ab117784f850ce11187a6da9bd9fc3d7e3e34dced67c66db4648d1f36635c0c9597d8847411e98b03

  • SSDEEP

    3072:s9PMwH9JqGWWZCrFbkrVwtCJXeex7rrIRZK8K8/kvl:qPRH5NZCpbkrVwtmeetrIyRl

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6cb11d6fcd77aa899f298260853f5878939d3f6e20611ef6c49f655e45b486e9.exe

    • Size

      161KB

    • MD5

      cd121e15fc93045676302de70d97002a

    • SHA1

      aa8ef03f60fee04376b957c757dd7eba3030d2c5

    • SHA256

      6cb11d6fcd77aa899f298260853f5878939d3f6e20611ef6c49f655e45b486e9

    • SHA512

      91f4c302f6678bd05bd6150e8a530316fdc8e001c796338ab117784f850ce11187a6da9bd9fc3d7e3e34dced67c66db4648d1f36635c0c9597d8847411e98b03

    • SSDEEP

      3072:s9PMwH9JqGWWZCrFbkrVwtCJXeex7rrIRZK8K8/kvl:qPRH5NZCpbkrVwtmeetrIyRl

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks