General

  • Target

    ac8c3e7c366e07e45c53acdd4352bf8b070053974607d9a6e44e22969891fac3N.exe

  • Size

    42KB

  • Sample

    241225-svpjtawqcs

  • MD5

    a20edb1a748afc860869266236b2d1e0

  • SHA1

    567468bfac15b58f58067e8b95614df9a8a30285

  • SHA256

    ac8c3e7c366e07e45c53acdd4352bf8b070053974607d9a6e44e22969891fac3

  • SHA512

    77001d1a389064d081db51c7f6260bdb1f31a95d90dfaedb920b97f57cc67685e5e75ae78e32fcafa6c107a51c5da8806f1c17f292c231f134bc8f19f4b37fff

  • SSDEEP

    768:sXH/eDERkLpp9TgGlgJ2TOmGTnejWNBL9m+3vTfsq/1H5:yWDHLp7TLiR9BLn/Dl

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      ac8c3e7c366e07e45c53acdd4352bf8b070053974607d9a6e44e22969891fac3N.exe

    • Size

      42KB

    • MD5

      a20edb1a748afc860869266236b2d1e0

    • SHA1

      567468bfac15b58f58067e8b95614df9a8a30285

    • SHA256

      ac8c3e7c366e07e45c53acdd4352bf8b070053974607d9a6e44e22969891fac3

    • SHA512

      77001d1a389064d081db51c7f6260bdb1f31a95d90dfaedb920b97f57cc67685e5e75ae78e32fcafa6c107a51c5da8806f1c17f292c231f134bc8f19f4b37fff

    • SSDEEP

      768:sXH/eDERkLpp9TgGlgJ2TOmGTnejWNBL9m+3vTfsq/1H5:yWDHLp7TLiR9BLn/Dl

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks