General

  • Target

    0b7c5e606923cfb32a5c56fbb5d105550c2307e0c26898f5c701f1dcf672b90e.exe

  • Size

    161KB

  • Sample

    241113-jya16aybjp

  • MD5

    f4d1003050ded885e8b4b0adb84f01ee

  • SHA1

    3f2868f478fdb2a448d5c72851a80a5554f11a42

  • SHA256

    0b7c5e606923cfb32a5c56fbb5d105550c2307e0c26898f5c701f1dcf672b90e

  • SHA512

    264f560dddaea60bf76ca01704fb5468362e60002730a645554b293a315d4ab06cd54f27df1d077df3999aa8dd6507c25ac4dcad7c9d9d376bffdc82baf1d753

  • SSDEEP

    3072:UUkewKuC5kuDFYK6543kfVwtCJXeex7rrIRZK8K8/kvz:RWKt5kSYy3kfVwtmeetrIyRz

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0b7c5e606923cfb32a5c56fbb5d105550c2307e0c26898f5c701f1dcf672b90e.exe

    • Size

      161KB

    • MD5

      f4d1003050ded885e8b4b0adb84f01ee

    • SHA1

      3f2868f478fdb2a448d5c72851a80a5554f11a42

    • SHA256

      0b7c5e606923cfb32a5c56fbb5d105550c2307e0c26898f5c701f1dcf672b90e

    • SHA512

      264f560dddaea60bf76ca01704fb5468362e60002730a645554b293a315d4ab06cd54f27df1d077df3999aa8dd6507c25ac4dcad7c9d9d376bffdc82baf1d753

    • SSDEEP

      3072:UUkewKuC5kuDFYK6543kfVwtCJXeex7rrIRZK8K8/kvz:RWKt5kSYy3kfVwtmeetrIyRz

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks