General

  • Target

    d339676945b8230d692d2a060ca48b9f3c9d94db5529899454ab3302f6eaf67fN

  • Size

    108KB

  • Sample

    241113-kpxz1axrby

  • MD5

    5a77d42fab2d4f38d0aefe6e502410a0

  • SHA1

    5d8bdc55dc4669af670d5b1b6daf235798c0f70f

  • SHA256

    d339676945b8230d692d2a060ca48b9f3c9d94db5529899454ab3302f6eaf67f

  • SHA512

    c48380a34936641c69073fa47853865c70c3b966c3178274ea17ccd73bfa1c07ac4312981eb09481c0ea18e19f63f0cc12e837e577485b867816fca8bf6863f5

  • SSDEEP

    1536:zUXBREdzQNxZ1dpzcme8jkizV/BX2FcFmKcUsvKwF:zUXBulQDZ1dsiJZmFcFmKcUsvKwF

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d339676945b8230d692d2a060ca48b9f3c9d94db5529899454ab3302f6eaf67fN

    • Size

      108KB

    • MD5

      5a77d42fab2d4f38d0aefe6e502410a0

    • SHA1

      5d8bdc55dc4669af670d5b1b6daf235798c0f70f

    • SHA256

      d339676945b8230d692d2a060ca48b9f3c9d94db5529899454ab3302f6eaf67f

    • SHA512

      c48380a34936641c69073fa47853865c70c3b966c3178274ea17ccd73bfa1c07ac4312981eb09481c0ea18e19f63f0cc12e837e577485b867816fca8bf6863f5

    • SSDEEP

      1536:zUXBREdzQNxZ1dpzcme8jkizV/BX2FcFmKcUsvKwF:zUXBulQDZ1dsiJZmFcFmKcUsvKwF

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks