General

  • Target

    77da2ad59b29619add3cc5d36c8f3123b9c9877a5821cd45735bae1964414b22N.exe

  • Size

    67KB

  • Sample

    241119-n7b22avraz

  • MD5

    bae56f77b9a7697f4a07f2e1b81a7eb0

  • SHA1

    d239c2112072b267ae7f788f4e5e0e530047268f

  • SHA256

    77da2ad59b29619add3cc5d36c8f3123b9c9877a5821cd45735bae1964414b22

  • SHA512

    a149c9c4e820532fde5dcf446dc0796d4eb9b07f2d879f884061ef7c6a4c3192cab7799f6fd5eff63964c1d18384dd8a95ae639a47d17427e282de2efe91218a

  • SSDEEP

    1536:SBe/ITDNrXqzYTlWKYBBeS3ragsJifTduD4oTxw:ORqzYTcKCBeS3mgsJibdMTxw

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      77da2ad59b29619add3cc5d36c8f3123b9c9877a5821cd45735bae1964414b22N.exe

    • Size

      67KB

    • MD5

      bae56f77b9a7697f4a07f2e1b81a7eb0

    • SHA1

      d239c2112072b267ae7f788f4e5e0e530047268f

    • SHA256

      77da2ad59b29619add3cc5d36c8f3123b9c9877a5821cd45735bae1964414b22

    • SHA512

      a149c9c4e820532fde5dcf446dc0796d4eb9b07f2d879f884061ef7c6a4c3192cab7799f6fd5eff63964c1d18384dd8a95ae639a47d17427e282de2efe91218a

    • SSDEEP

      1536:SBe/ITDNrXqzYTlWKYBBeS3ragsJifTduD4oTxw:ORqzYTcKCBeS3mgsJibdMTxw

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks