Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8d1bca4bba87068325f36f8c1bf51766c046fadd1cae1e337240c43e8338116bN

  • Size

    72KB

  • Sample

    240919-sa2zeavenk

  • MD5

    c30c71acbb27bc07863f18c6933591d0

  • SHA1

    9bd0bf335b98679d7d71f14d5b70136c62cb72d4

  • SHA256

    8d1bca4bba87068325f36f8c1bf51766c046fadd1cae1e337240c43e8338116b

  • SHA512

    5748e2d193d27eabed6173508ebe68fa68d83e4c141d0782c78cb4e920dbbcce726201a797b9b9ab88fb830c2a11c2f6a154ed39245eb1210f98668cb8187168

  • SSDEEP

    768:EpxuzEa8DBDklDNr4QZ4pJHtHRXzaO/1H582U9UiEb/KEiEixV38Hiv+X2td4A:Epk4Dx+Nr4y4zN1nGPgUN3QivEtA

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      8d1bca4bba87068325f36f8c1bf51766c046fadd1cae1e337240c43e8338116bN

    • Size

      72KB

    • MD5

      c30c71acbb27bc07863f18c6933591d0

    • SHA1

      9bd0bf335b98679d7d71f14d5b70136c62cb72d4

    • SHA256

      8d1bca4bba87068325f36f8c1bf51766c046fadd1cae1e337240c43e8338116b

    • SHA512

      5748e2d193d27eabed6173508ebe68fa68d83e4c141d0782c78cb4e920dbbcce726201a797b9b9ab88fb830c2a11c2f6a154ed39245eb1210f98668cb8187168

    • SSDEEP

      768:EpxuzEa8DBDklDNr4QZ4pJHtHRXzaO/1H582U9UiEb/KEiEixV38Hiv+X2td4A:Epk4Dx+Nr4y4zN1nGPgUN3QivEtA

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks