General

  • Target

    50d4fd4d4c98eef0d0ef262fe542e1234c78b3a26163f48a9809f6333ac4d9e8N.exe

  • Size

    94KB

  • Sample

    241112-rqrmyaxnek

  • MD5

    b88001c0dcb59ec8f9b9c6ff2975c110

  • SHA1

    b6b655bbcf247140ef7d2ce46d42d271c4197572

  • SHA256

    50d4fd4d4c98eef0d0ef262fe542e1234c78b3a26163f48a9809f6333ac4d9e8

  • SHA512

    3a94c6a4a87cd2f528d2136ccd97ee50302e03239ac7222f3b2901f984406cf9c81756cf9545bd02b0b66ae149cf883d739c3b8ff05b3389c5e9c6e4a8c0b17d

  • SSDEEP

    1536:im2ARzQyxr4/qihmDwPMEgUcbwqTpcSTqGYgjA7+aK4UY6KnXNlLRUf5kJb5N5td:C0zQ+r4/7ADwPMEjcbDTpjKD/tUaOeHv

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      50d4fd4d4c98eef0d0ef262fe542e1234c78b3a26163f48a9809f6333ac4d9e8N.exe

    • Size

      94KB

    • MD5

      b88001c0dcb59ec8f9b9c6ff2975c110

    • SHA1

      b6b655bbcf247140ef7d2ce46d42d271c4197572

    • SHA256

      50d4fd4d4c98eef0d0ef262fe542e1234c78b3a26163f48a9809f6333ac4d9e8

    • SHA512

      3a94c6a4a87cd2f528d2136ccd97ee50302e03239ac7222f3b2901f984406cf9c81756cf9545bd02b0b66ae149cf883d739c3b8ff05b3389c5e9c6e4a8c0b17d

    • SSDEEP

      1536:im2ARzQyxr4/qihmDwPMEgUcbwqTpcSTqGYgjA7+aK4UY6KnXNlLRUf5kJb5N5td:C0zQ+r4/7ADwPMEjcbDTpjKD/tUaOeHv

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks