General

  • Target

    e7e8c246243a6ea181c75fcfee974ad56a95824fc5871e7d712d94808f60476bN.exe

  • Size

    229KB

  • Sample

    241113-1pqtpazfpr

  • MD5

    394eb1499f5f3a3c0547c7a321112270

  • SHA1

    5ee92a88b7795fb428e4bbac42d4339de14eb109

  • SHA256

    e7e8c246243a6ea181c75fcfee974ad56a95824fc5871e7d712d94808f60476b

  • SHA512

    5060723c6b524d2195ee640f4f60359bda89937c33b2de8cc103d1ec7f1b2b62dde472587c10abeceb3f8ccfed0f9a9b8b7f91fec8a50d9e2ac695b93aef0607

  • SSDEEP

    6144:TOeQhIfdPvO7Mb5Lu271+HZ/pvkym/89bYEwPhCKvav:CSRvO7Mbt7AIfFfvav

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e7e8c246243a6ea181c75fcfee974ad56a95824fc5871e7d712d94808f60476bN.exe

    • Size

      229KB

    • MD5

      394eb1499f5f3a3c0547c7a321112270

    • SHA1

      5ee92a88b7795fb428e4bbac42d4339de14eb109

    • SHA256

      e7e8c246243a6ea181c75fcfee974ad56a95824fc5871e7d712d94808f60476b

    • SHA512

      5060723c6b524d2195ee640f4f60359bda89937c33b2de8cc103d1ec7f1b2b62dde472587c10abeceb3f8ccfed0f9a9b8b7f91fec8a50d9e2ac695b93aef0607

    • SSDEEP

      6144:TOeQhIfdPvO7Mb5Lu271+HZ/pvkym/89bYEwPhCKvav:CSRvO7Mbt7AIfFfvav

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks