Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TrojanDownloader.Win32.Berbew.pz-3091b8b8f360b8c5839563cf2f1d06ef0cf98eab17fed3e7d9232c7816dd80caN

  • Size

    94KB

  • Sample

    240916-tmaalawhpe

  • MD5

    a65483eada542670e476c11eaf6224c0

  • SHA1

    1191207d094e2b65f496d78e28f56a20644f0917

  • SHA256

    3091b8b8f360b8c5839563cf2f1d06ef0cf98eab17fed3e7d9232c7816dd80ca

  • SHA512

    842c55b40742a4ff6c998888e04cdd37e6e8b02cc7ca8f456335f9ebe447012407b7c54dc5466f94435833a6eab07e049ef80a9a5207cb3c046c4b713e575aeb

  • SSDEEP

    1536:57LGzOulK1QtkUmZYu5sRYWIX8mXagj3DNM4/wbi1nxsRVkeyyVr3iwcH2ogHx:5uoamY8sRYWIJPj3DW4/wG1i3kremwcA

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      TrojanDownloader.Win32.Berbew.pz-3091b8b8f360b8c5839563cf2f1d06ef0cf98eab17fed3e7d9232c7816dd80caN

    • Size

      94KB

    • MD5

      a65483eada542670e476c11eaf6224c0

    • SHA1

      1191207d094e2b65f496d78e28f56a20644f0917

    • SHA256

      3091b8b8f360b8c5839563cf2f1d06ef0cf98eab17fed3e7d9232c7816dd80ca

    • SHA512

      842c55b40742a4ff6c998888e04cdd37e6e8b02cc7ca8f456335f9ebe447012407b7c54dc5466f94435833a6eab07e049ef80a9a5207cb3c046c4b713e575aeb

    • SSDEEP

      1536:57LGzOulK1QtkUmZYu5sRYWIX8mXagj3DNM4/wbi1nxsRVkeyyVr3iwcH2ogHx:5uoamY8sRYWIJPj3DW4/wG1i3kremwcA

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks