Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Backdoor.Win32.Berbew.pz-3db6d84f7c39834c97290e11cc9d479b4a9177ceb2d93b40edcc10086e76ec4bN

  • Size

    55KB

  • Sample

    240916-tmh8haxbkl

  • MD5

    e229a69236c25a604bab587813363020

  • SHA1

    605b9f62f9d08311ab6e4782003c8818e5599e60

  • SHA256

    3db6d84f7c39834c97290e11cc9d479b4a9177ceb2d93b40edcc10086e76ec4b

  • SHA512

    496eaebfbcca171fc25fbc43e212ba4837c41a04712b4e119e23024f1191c1fb21a96ccb63caf4a3bdc30f17386bbc64c22525aa62dad44f309edd7e2bd658d6

  • SSDEEP

    1536:ra2SreCELHlsvCUBxFAZ3aNGyx7mJjdjvM087:G2SreCzu3xyxSJpjM9

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      Backdoor.Win32.Berbew.pz-3db6d84f7c39834c97290e11cc9d479b4a9177ceb2d93b40edcc10086e76ec4bN

    • Size

      55KB

    • MD5

      e229a69236c25a604bab587813363020

    • SHA1

      605b9f62f9d08311ab6e4782003c8818e5599e60

    • SHA256

      3db6d84f7c39834c97290e11cc9d479b4a9177ceb2d93b40edcc10086e76ec4b

    • SHA512

      496eaebfbcca171fc25fbc43e212ba4837c41a04712b4e119e23024f1191c1fb21a96ccb63caf4a3bdc30f17386bbc64c22525aa62dad44f309edd7e2bd658d6

    • SSDEEP

      1536:ra2SreCELHlsvCUBxFAZ3aNGyx7mJjdjvM087:G2SreCzu3xyxSJpjM9

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks