General

  • Target

    7d61960f9fbf3fe4c2e106dcdb174f0dcc748edfdbca012713dfc4bf974f3c76N.exe

  • Size

    42KB

  • Sample

    241207-xf68jatlcq

  • MD5

    afb0741fbdd3c806ccc461a631c4a8d0

  • SHA1

    bdad7fdf2d72bd4d9bccc125761023477a446792

  • SHA256

    7d61960f9fbf3fe4c2e106dcdb174f0dcc748edfdbca012713dfc4bf974f3c76

  • SHA512

    3d81c94774918fb192707701628fb369c5621506345c862dc47d69107059a2d1e332111f47f73dd9e56f859fe4f2879f758791778ca7e56565b9e421334f3404

  • SSDEEP

    768:INZkBNxveWdjWVn1RJU6fGwfHsWOdM5NeyAle2/1H5O:oKPDS5PJjfRfIa5NQJ

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      7d61960f9fbf3fe4c2e106dcdb174f0dcc748edfdbca012713dfc4bf974f3c76N.exe

    • Size

      42KB

    • MD5

      afb0741fbdd3c806ccc461a631c4a8d0

    • SHA1

      bdad7fdf2d72bd4d9bccc125761023477a446792

    • SHA256

      7d61960f9fbf3fe4c2e106dcdb174f0dcc748edfdbca012713dfc4bf974f3c76

    • SHA512

      3d81c94774918fb192707701628fb369c5621506345c862dc47d69107059a2d1e332111f47f73dd9e56f859fe4f2879f758791778ca7e56565b9e421334f3404

    • SSDEEP

      768:INZkBNxveWdjWVn1RJU6fGwfHsWOdM5NeyAle2/1H5O:oKPDS5PJjfRfIa5NQJ

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks