General

  • Target

    b6a0a7d2e54c15acbfc30d59d3ad1402ed67418afc1d8669595973503842c3a4

  • Size

    128KB

  • Sample

    241223-cvyvgstrbt

  • MD5

    8b0a3338054b4ebb8aa308a48039b521

  • SHA1

    7f9e38664c2212ae6748185bf771d1c531529434

  • SHA256

    b6a0a7d2e54c15acbfc30d59d3ad1402ed67418afc1d8669595973503842c3a4

  • SHA512

    7bff8358664de4d8722aa01d5984e0c6dab96a0cb7a65a7d3185027cf0665c251204046fb14deb113e8433c96edb7348843f1a2647e498763d5f2356b4f4487f

  • SSDEEP

    1536:j4PBYU+9/cjVYumDNZvyA2QjILQ9FKGXllUDtM60TD4ruhiZlrQIFiglF9xZ95Q:jMl+Z4VMvy0KG7UDd0pCrQIFdFtLQ

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      b6a0a7d2e54c15acbfc30d59d3ad1402ed67418afc1d8669595973503842c3a4

    • Size

      128KB

    • MD5

      8b0a3338054b4ebb8aa308a48039b521

    • SHA1

      7f9e38664c2212ae6748185bf771d1c531529434

    • SHA256

      b6a0a7d2e54c15acbfc30d59d3ad1402ed67418afc1d8669595973503842c3a4

    • SHA512

      7bff8358664de4d8722aa01d5984e0c6dab96a0cb7a65a7d3185027cf0665c251204046fb14deb113e8433c96edb7348843f1a2647e498763d5f2356b4f4487f

    • SSDEEP

      1536:j4PBYU+9/cjVYumDNZvyA2QjILQ9FKGXllUDtM60TD4ruhiZlrQIFiglF9xZ95Q:jMl+Z4VMvy0KG7UDd0pCrQIFdFtLQ

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks