Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TrojanDownloader.Win32.Berbew.pz-25f8b241d791619ed7a14130004eda92fa35f0af26dca4c3d51c9dab71270d74N

  • Size

    64KB

  • Sample

    240916-tdk1qswfkp

  • MD5

    84a7de39b34e1cf1b55983c3c524cdf0

  • SHA1

    2889b5457acdfccd5548bd4a5350760f14681a49

  • SHA256

    25f8b241d791619ed7a14130004eda92fa35f0af26dca4c3d51c9dab71270d74

  • SHA512

    89011960edf255077cd815d725371fc94cccae65b761bf6e5907a03edbee5d812efaa7aa28a4f790657475bc3236c7f66220a2ced435f10ef95f953e602f3182

  • SSDEEP

    768:Si25t7BqJcpo8KeHdpBV0XFBxxI2eOcsJfAI/1H54FY8KA2kms8Y/ts/9d2NzYVV:S3/E98zdpBuHxcKBnWy8rPFW2iwTbW

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      TrojanDownloader.Win32.Berbew.pz-25f8b241d791619ed7a14130004eda92fa35f0af26dca4c3d51c9dab71270d74N

    • Size

      64KB

    • MD5

      84a7de39b34e1cf1b55983c3c524cdf0

    • SHA1

      2889b5457acdfccd5548bd4a5350760f14681a49

    • SHA256

      25f8b241d791619ed7a14130004eda92fa35f0af26dca4c3d51c9dab71270d74

    • SHA512

      89011960edf255077cd815d725371fc94cccae65b761bf6e5907a03edbee5d812efaa7aa28a4f790657475bc3236c7f66220a2ced435f10ef95f953e602f3182

    • SSDEEP

      768:Si25t7BqJcpo8KeHdpBV0XFBxxI2eOcsJfAI/1H54FY8KA2kms8Y/ts/9d2NzYVV:S3/E98zdpBuHxcKBnWy8rPFW2iwTbW

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks