Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bf9365b436...9N.exe

windows7-x64

10

bf9365b436...9N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf9365b436a5d95f333f2aec9e1642103193ef7cb23a5347b89e772175223699N.exe

  • Size

    320KB

  • Sample

    240925-3gywfaxaqb

  • MD5

    a449855d2f2258853dcf6c0e8f6484d0

  • SHA1

    87e68e649317cea59466e71e07940d5ced863a63

  • SHA256

    bf9365b436a5d95f333f2aec9e1642103193ef7cb23a5347b89e772175223699

  • SHA512

    7816f1935c131b44e789465120d841b747e2fd3fb56a10914b884be128095cd1b43c37bdce8ba874ce234d1d1d672513fd20069e751ed686256c6d6cda7a4f05

  • SSDEEP

    3072:HDTjlPHaNDAKG8rmfX/zGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmOH6ipNik0O:zlPHadAiq/LGyZ6YugQdjGG1wsKm06D4

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bf9365b436a5d95f333f2aec9e1642103193ef7cb23a5347b89e772175223699N.exe

    • Size

      320KB

    • MD5

      a449855d2f2258853dcf6c0e8f6484d0

    • SHA1

      87e68e649317cea59466e71e07940d5ced863a63

    • SHA256

      bf9365b436a5d95f333f2aec9e1642103193ef7cb23a5347b89e772175223699

    • SHA512

      7816f1935c131b44e789465120d841b747e2fd3fb56a10914b884be128095cd1b43c37bdce8ba874ce234d1d1d672513fd20069e751ed686256c6d6cda7a4f05

    • SSDEEP

      3072:HDTjlPHaNDAKG8rmfX/zGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmOH6ipNik0O:zlPHadAiq/LGyZ6YugQdjGG1wsKm06D4

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks