Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TrojanDownloader.Win32.Berbew.pz-87184cd4df95993e9395f7d44492c19fa863c3b9a55ceb9221cc33baa69696c5N

  • Size

    224KB

  • Sample

    240916-tp48raxbjh

  • MD5

    be3893178152f74093dfbf2fffeea2e0

  • SHA1

    5d2db06cebc13d41cda47ff592809635cab85f9b

  • SHA256

    87184cd4df95993e9395f7d44492c19fa863c3b9a55ceb9221cc33baa69696c5

  • SHA512

    f98bd4099e3ad0a2b71598d7bb65e773135ea6878cc91c79050f2d5dd361310a199817cf5692deb640c3db115b9229351cd4785b52af7353b074dd243fa335bc

  • SSDEEP

    3072:PfrC6Ni0q0D8Ij5GURlSjgjxxt8vgHq/Wp+YmKfxgQdxvzSTsXXoT2971qqWMuY:Pfmtm8Ij5LRlUivKvUmKyIxLDXXoq9F1

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      TrojanDownloader.Win32.Berbew.pz-87184cd4df95993e9395f7d44492c19fa863c3b9a55ceb9221cc33baa69696c5N

    • Size

      224KB

    • MD5

      be3893178152f74093dfbf2fffeea2e0

    • SHA1

      5d2db06cebc13d41cda47ff592809635cab85f9b

    • SHA256

      87184cd4df95993e9395f7d44492c19fa863c3b9a55ceb9221cc33baa69696c5

    • SHA512

      f98bd4099e3ad0a2b71598d7bb65e773135ea6878cc91c79050f2d5dd361310a199817cf5692deb640c3db115b9229351cd4785b52af7353b074dd243fa335bc

    • SSDEEP

      3072:PfrC6Ni0q0D8Ij5GURlSjgjxxt8vgHq/Wp+YmKfxgQdxvzSTsXXoT2971qqWMuY:Pfmtm8Ij5LRlUivKvUmKyIxLDXXoq9F1

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks