Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6ac28d53e587bf1f7eccb67876079f1f5df986fa7ab889d1b11df8bf0f3fee05N

  • Size

    45KB

  • Sample

    240927-gzm11a1hrg

  • MD5

    c4c3a308a2b2ae9108278b3dd4b1dad0

  • SHA1

    3903d729349b7f30f732c8098641a9bfae5f6be5

  • SHA256

    6ac28d53e587bf1f7eccb67876079f1f5df986fa7ab889d1b11df8bf0f3fee05

  • SHA512

    e1d1e111cd67c33549938097c373089d67a1570a41882f57754e900b3e93c3c9aa0367817c88b84924842b8e1d6d797ae432136a7ce8d4d2a51fdd90663aed49

  • SSDEEP

    768:908YdhJlwRJrBA2Zwf3lArO7UUcgaIZfP6f/FhLZq/1H5N:yTJuRJrBA8wf3lRFvSf/FhLSr

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      6ac28d53e587bf1f7eccb67876079f1f5df986fa7ab889d1b11df8bf0f3fee05N

    • Size

      45KB

    • MD5

      c4c3a308a2b2ae9108278b3dd4b1dad0

    • SHA1

      3903d729349b7f30f732c8098641a9bfae5f6be5

    • SHA256

      6ac28d53e587bf1f7eccb67876079f1f5df986fa7ab889d1b11df8bf0f3fee05

    • SHA512

      e1d1e111cd67c33549938097c373089d67a1570a41882f57754e900b3e93c3c9aa0367817c88b84924842b8e1d6d797ae432136a7ce8d4d2a51fdd90663aed49

    • SSDEEP

      768:908YdhJlwRJrBA2Zwf3lArO7UUcgaIZfP6f/FhLZq/1H5N:yTJuRJrBA8wf3lRFvSf/FhLSr

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks