Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

feea3e519a...6N.exe

windows7-x64

10

feea3e519a...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    feea3e519a14cd6f7c3c07aec2f34f9cda63a72db78896d5fb6d9080a356dc56N

  • Size

    276KB

  • Sample

    240921-v4mgxsvamc

  • MD5

    ea3ea5ec636bce993e41989ba5d737f0

  • SHA1

    02afaf172addacde5b668af27fd027b5c4b5133b

  • SHA256

    feea3e519a14cd6f7c3c07aec2f34f9cda63a72db78896d5fb6d9080a356dc56

  • SHA512

    f2c04b2068e10008f91b0270da508860eee7e9c6d3f0dabe6f3760b9d60704b20ea8f1123c45bc0cd95feccec9954ee2edc8358b8a9d1b047e216030b5a57f15

  • SSDEEP

    6144:PqX7MKsnRByfa/iROdWZHEFJ7aWN1rtMsQBOSGaF+:CX7IyS2HEGWN1RMs1S7

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      feea3e519a14cd6f7c3c07aec2f34f9cda63a72db78896d5fb6d9080a356dc56N

    • Size

      276KB

    • MD5

      ea3ea5ec636bce993e41989ba5d737f0

    • SHA1

      02afaf172addacde5b668af27fd027b5c4b5133b

    • SHA256

      feea3e519a14cd6f7c3c07aec2f34f9cda63a72db78896d5fb6d9080a356dc56

    • SHA512

      f2c04b2068e10008f91b0270da508860eee7e9c6d3f0dabe6f3760b9d60704b20ea8f1123c45bc0cd95feccec9954ee2edc8358b8a9d1b047e216030b5a57f15

    • SSDEEP

      6144:PqX7MKsnRByfa/iROdWZHEFJ7aWN1rtMsQBOSGaF+:CX7IyS2HEGWN1RMs1S7

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks