Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

6e1fe431a1...bf.exe

windows7-x64

10

6e1fe431a1...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e1fe431a13dfd68e98997d3b0586dd3cc96f3ab870fcbaab17dd5a81996f9bf

  • Size

    128KB

  • Sample

    240918-2np2faxdkp

  • MD5

    a86367a258bb28cfe17edd9258663258

  • SHA1

    2c4aee944cbe09f8bc9619327bfa8b44ad757e87

  • SHA256

    6e1fe431a13dfd68e98997d3b0586dd3cc96f3ab870fcbaab17dd5a81996f9bf

  • SHA512

    94695408f8e78bc36c6dcc63b00ed0fd340fb56fbcaa3317d725f2dfaa70e902f4c925bc8f92c303df1ee66a38e1c0d7b0dfb6041aae53476cbeeec4dfc55dfc

  • SSDEEP

    3072:bayUZwQNxPXO7o4m3TRXimW2wS7IrHrYj:2yU/NxPXcmRSmHwMOHm

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6e1fe431a13dfd68e98997d3b0586dd3cc96f3ab870fcbaab17dd5a81996f9bf

    • Size

      128KB

    • MD5

      a86367a258bb28cfe17edd9258663258

    • SHA1

      2c4aee944cbe09f8bc9619327bfa8b44ad757e87

    • SHA256

      6e1fe431a13dfd68e98997d3b0586dd3cc96f3ab870fcbaab17dd5a81996f9bf

    • SHA512

      94695408f8e78bc36c6dcc63b00ed0fd340fb56fbcaa3317d725f2dfaa70e902f4c925bc8f92c303df1ee66a38e1c0d7b0dfb6041aae53476cbeeec4dfc55dfc

    • SSDEEP

      3072:bayUZwQNxPXO7o4m3TRXimW2wS7IrHrYj:2yU/NxPXcmRSmHwMOHm

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks