General

  • Target

    f05952437801283a63daf05f6b9a3ac5252101ecb29dff69246fb78f0230280b.exe

  • Size

    161KB

  • Sample

    241112-rbpvsstgrr

  • MD5

    b5649815feea2777064473d3c297169e

  • SHA1

    39f7162181adc20aeaad024323f9e40c1da55257

  • SHA256

    f05952437801283a63daf05f6b9a3ac5252101ecb29dff69246fb78f0230280b

  • SHA512

    d936c5364f0e20c57661e433dc158a782f1af5179566c9178da7575aa44bdceb982b6ea0d25887dbdbc3df218418e59028d15742669ad11fa7a95cb71a593738

  • SSDEEP

    3072:kunLiMu1NNl9eOutFZvkZVwtCJXeex7rrIRZK8K8/kvf:kunLwNNl9et9vkZVwtmeetrIyRf

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f05952437801283a63daf05f6b9a3ac5252101ecb29dff69246fb78f0230280b.exe

    • Size

      161KB

    • MD5

      b5649815feea2777064473d3c297169e

    • SHA1

      39f7162181adc20aeaad024323f9e40c1da55257

    • SHA256

      f05952437801283a63daf05f6b9a3ac5252101ecb29dff69246fb78f0230280b

    • SHA512

      d936c5364f0e20c57661e433dc158a782f1af5179566c9178da7575aa44bdceb982b6ea0d25887dbdbc3df218418e59028d15742669ad11fa7a95cb71a593738

    • SSDEEP

      3072:kunLiMu1NNl9eOutFZvkZVwtCJXeex7rrIRZK8K8/kvf:kunLwNNl9et9vkZVwtmeetrIyRf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks