General

  • Target

    35e5f6a6b87f02476b9d2e20fc75fd085dfc27527fc8116017c0ff21e50bb4a6.exe

  • Size

    67KB

  • Sample

    241112-reg95axlhk

  • MD5

    f826d73763cd94b59398f1bb29a69a6d

  • SHA1

    fcb4e18395cda689d95250eb0a86139a0e27f645

  • SHA256

    35e5f6a6b87f02476b9d2e20fc75fd085dfc27527fc8116017c0ff21e50bb4a6

  • SHA512

    780ddc165d3b9d0829f4aff4e28b1e4e3612ef85983b24bb1bae3969f80ac98a15d1075ae8d2699cecf5606030e831c76fa6d362b8a382a2ebec0674c12eb2bb

  • SSDEEP

    1536:7NEN0O+3u6tLnL70/q3r/sJifTduD4oTxwN:GnMua0i3r/sJibdMTxwN

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      35e5f6a6b87f02476b9d2e20fc75fd085dfc27527fc8116017c0ff21e50bb4a6.exe

    • Size

      67KB

    • MD5

      f826d73763cd94b59398f1bb29a69a6d

    • SHA1

      fcb4e18395cda689d95250eb0a86139a0e27f645

    • SHA256

      35e5f6a6b87f02476b9d2e20fc75fd085dfc27527fc8116017c0ff21e50bb4a6

    • SHA512

      780ddc165d3b9d0829f4aff4e28b1e4e3612ef85983b24bb1bae3969f80ac98a15d1075ae8d2699cecf5606030e831c76fa6d362b8a382a2ebec0674c12eb2bb

    • SSDEEP

      1536:7NEN0O+3u6tLnL70/q3r/sJifTduD4oTxwN:GnMua0i3r/sJibdMTxwN

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks