General

  • Target

    3523d2fe633f30cf6e97995ff1851af243f53a6101e3244aed16a07e194a21ae.exe

  • Size

    117KB

  • Sample

    241113-vmnzesyqgr

  • MD5

    a6ddb78eda614c9bc55e590d354c4773

  • SHA1

    f104a31be35c462004caa8f3e532d4a5ea37ce2a

  • SHA256

    3523d2fe633f30cf6e97995ff1851af243f53a6101e3244aed16a07e194a21ae

  • SHA512

    5db482f0185239688daee01c2de0cb5bd009619b2863534dd02c6957413b02414c46d4e43e6b341a043061e05b5a046145b23bdf94720dcfbaf778474dfad1b4

  • SSDEEP

    1536:mqR5kw/yLg8c6fKPhOvNFbEvvGUqzYNnq9wmBBR1wFWOFFfUN1Avhw6JCMh:BR5PFmKPhWF4nbq88f1OFFfUrQlMU

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      3523d2fe633f30cf6e97995ff1851af243f53a6101e3244aed16a07e194a21ae.exe

    • Size

      117KB

    • MD5

      a6ddb78eda614c9bc55e590d354c4773

    • SHA1

      f104a31be35c462004caa8f3e532d4a5ea37ce2a

    • SHA256

      3523d2fe633f30cf6e97995ff1851af243f53a6101e3244aed16a07e194a21ae

    • SHA512

      5db482f0185239688daee01c2de0cb5bd009619b2863534dd02c6957413b02414c46d4e43e6b341a043061e05b5a046145b23bdf94720dcfbaf778474dfad1b4

    • SSDEEP

      1536:mqR5kw/yLg8c6fKPhOvNFbEvvGUqzYNnq9wmBBR1wFWOFFfUN1Avhw6JCMh:BR5PFmKPhWF4nbq88f1OFFfUrQlMU

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks