Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

NEAS.d9a43...30.exe

windows7-x64

10

NEAS.d9a43...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.d9a43961c899fc2947ec5a26cd263c30.exe

  • Size

    341KB

  • Sample

    231105-2173saeb7t

  • MD5

    d9a43961c899fc2947ec5a26cd263c30

  • SHA1

    0770410f5e9e3c1a58afbf8211ada5df36894236

  • SHA256

    35cf3ad040e370ea6febd200318776837ece71f06fc7e46392f2f6e55e860851

  • SHA512

    b65acb18ce381c9fd6976205d3802b49063e173e7f620b328a8d89317056b378eb2db328fcd52c652bb44ed13cbcee6b066d5efb2de71b62baf39cba6a2b22e1

  • SSDEEP

    6144:grnkP+6bB0H9rj3fMMICM4kfBbSVtxzcdNg/SOPOoUkZUuOsOjbSMu6l3bS64u5U:gQ+Qu9yus9exo/iSuU8OsitH5og+

Score
10/10
berbewadwaredropperpersistencestealertrojan

Malware Config

Targets

    • Target

      NEAS.d9a43961c899fc2947ec5a26cd263c30.exe

    • Size

      341KB

    • MD5

      d9a43961c899fc2947ec5a26cd263c30

    • SHA1

      0770410f5e9e3c1a58afbf8211ada5df36894236

    • SHA256

      35cf3ad040e370ea6febd200318776837ece71f06fc7e46392f2f6e55e860851

    • SHA512

      b65acb18ce381c9fd6976205d3802b49063e173e7f620b328a8d89317056b378eb2db328fcd52c652bb44ed13cbcee6b066d5efb2de71b62baf39cba6a2b22e1

    • SSDEEP

      6144:grnkP+6bB0H9rj3fMMICM4kfBbSVtxzcdNg/SOPOoUkZUuOsOjbSMu6l3bS64u5U:gQ+Qu9yus9exo/iSuU8OsitH5og+

    Score
    10/10
    adwaredropperpersistencestealertrojan

    • Malware Backdoor - Berbew

      Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

      persistencedroppertrojan

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks