General

  • Target

    a39b181a77ae51aa392770c69d1c01f40f7ffdde93401628e70290e62f592e17.exe

  • Size

    69KB

  • Sample

    241113-km9k1sxqgy

  • MD5

    95fedcd93b7568dd35cb7aabbbc8f99b

  • SHA1

    2e8fca0b9bceed19e332561107217d3bc88e7e60

  • SHA256

    a39b181a77ae51aa392770c69d1c01f40f7ffdde93401628e70290e62f592e17

  • SHA512

    249f5343f93a333ca308335143cd1761e4c0a39df85e4ab0ca922b12d3147f48b3d92afd5581e7db28fa83418c3ca361b6ec575eb1ff7424c70134356006d2a6

  • SSDEEP

    1536:Zs5Af0oUkpnSzUGwGxL9DcvcoMspXS63Nein/GFZCeDAyV:Zs5AMos7woicVspXSSNFn/GFZC1yV

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      a39b181a77ae51aa392770c69d1c01f40f7ffdde93401628e70290e62f592e17.exe

    • Size

      69KB

    • MD5

      95fedcd93b7568dd35cb7aabbbc8f99b

    • SHA1

      2e8fca0b9bceed19e332561107217d3bc88e7e60

    • SHA256

      a39b181a77ae51aa392770c69d1c01f40f7ffdde93401628e70290e62f592e17

    • SHA512

      249f5343f93a333ca308335143cd1761e4c0a39df85e4ab0ca922b12d3147f48b3d92afd5581e7db28fa83418c3ca361b6ec575eb1ff7424c70134356006d2a6

    • SSDEEP

      1536:Zs5Af0oUkpnSzUGwGxL9DcvcoMspXS63Nein/GFZCeDAyV:Zs5AMos7woicVspXSSNFn/GFZC1yV

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks