General

  • Target

    46180253173b46b63a2887b5736c4566343bbf091071924bd724b7bdf9a27d39

  • Size

    194KB

  • Sample

    241123-1tpr7aylex

  • MD5

    92cf168e22cee8d04159013f5b3edf44

  • SHA1

    7ea8e8e7475ef4efd99488a4b6bb0bb5cb2c0450

  • SHA256

    46180253173b46b63a2887b5736c4566343bbf091071924bd724b7bdf9a27d39

  • SHA512

    08336c5fc4e015e30ab613dfddb2fc4fb8ecb133d95645eae95ca3ef85a78920d961811120b68257ef0a9cbb65a2fecd6b6a2ce1532ad61adf6cca820349d0bf

  • SSDEEP

    3072:bDjLIZb8QCDQSTJQmMIM/kEmMIGumMIc/1GV:PHIkFQ5/pbuh/UV

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      46180253173b46b63a2887b5736c4566343bbf091071924bd724b7bdf9a27d39

    • Size

      194KB

    • MD5

      92cf168e22cee8d04159013f5b3edf44

    • SHA1

      7ea8e8e7475ef4efd99488a4b6bb0bb5cb2c0450

    • SHA256

      46180253173b46b63a2887b5736c4566343bbf091071924bd724b7bdf9a27d39

    • SHA512

      08336c5fc4e015e30ab613dfddb2fc4fb8ecb133d95645eae95ca3ef85a78920d961811120b68257ef0a9cbb65a2fecd6b6a2ce1532ad61adf6cca820349d0bf

    • SSDEEP

      3072:bDjLIZb8QCDQSTJQmMIM/kEmMIGumMIc/1GV:PHIkFQ5/pbuh/UV

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks