Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Backdoor.Win32.Padodor.SK.MTB-492951f199fc9e6531bd584db045fd1d20be350882749860859ae27657fc7f56N

  • Size

    96KB

  • Sample

    240916-tnrw2axamf

  • MD5

    40c9b0e2bbac6d91be50ded34a3fc890

  • SHA1

    026f30c1dd4cab2e9c6d36f96d22a1a0a448ca8f

  • SHA256

    492951f199fc9e6531bd584db045fd1d20be350882749860859ae27657fc7f56

  • SHA512

    aa1bfcb88034ebbf2aaaeafa3890a1ba89db8615acdd665d9569ad962d882c988677f491fffec261d86ffbf032a41864e1f1454c26103f847bc1a7763a016ef3

  • SSDEEP

    1536:Z92/+AFZWS4jRGn5KQdzkEvHWytJabJSwZF2LF3mhLduV9jojTIvjrH:ZU7FZWFGzkq2yfHLFsLd69jc0vf

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      Backdoor.Win32.Padodor.SK.MTB-492951f199fc9e6531bd584db045fd1d20be350882749860859ae27657fc7f56N

    • Size

      96KB

    • MD5

      40c9b0e2bbac6d91be50ded34a3fc890

    • SHA1

      026f30c1dd4cab2e9c6d36f96d22a1a0a448ca8f

    • SHA256

      492951f199fc9e6531bd584db045fd1d20be350882749860859ae27657fc7f56

    • SHA512

      aa1bfcb88034ebbf2aaaeafa3890a1ba89db8615acdd665d9569ad962d882c988677f491fffec261d86ffbf032a41864e1f1454c26103f847bc1a7763a016ef3

    • SSDEEP

      1536:Z92/+AFZWS4jRGn5KQdzkEvHWytJabJSwZF2LF3mhLduV9jojTIvjrH:ZU7FZWFGzkq2yfHLFsLd69jc0vf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks