Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

b82f67cd9c...7N.exe

windows7-x64

10

b82f67cd9c...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b82f67cd9c0b84c78488b4ee7e1ca56f2f7a5747c3fa6d9782ffdfde7ca647c7N

  • Size

    89KB

  • Sample

    240928-ap2cbazcjb

  • MD5

    83d96066bbb3d56a619bf5a2a4521000

  • SHA1

    4a376d17f4a607f64f5b3a9dbf6090cdf4ee5538

  • SHA256

    b82f67cd9c0b84c78488b4ee7e1ca56f2f7a5747c3fa6d9782ffdfde7ca647c7

  • SHA512

    e8b0ab6c4d05899bafb69b11889d888c88179f62750d02088ea378dac5c763ea56f94d27af8290287a0212c17dc4d11281a7c706e6b22fbb4c5a9c6701610bc5

  • SSDEEP

    1536:O3HET0AC+nWd9hF8IkvdJQJxTrum1+oaX2QGFRQjD68a+VMKKTRVGFtUhQfR1WRw:O3DXzFev4Jx/um5aX2/eir4MKy3G7UEb

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b82f67cd9c0b84c78488b4ee7e1ca56f2f7a5747c3fa6d9782ffdfde7ca647c7N

    • Size

      89KB

    • MD5

      83d96066bbb3d56a619bf5a2a4521000

    • SHA1

      4a376d17f4a607f64f5b3a9dbf6090cdf4ee5538

    • SHA256

      b82f67cd9c0b84c78488b4ee7e1ca56f2f7a5747c3fa6d9782ffdfde7ca647c7

    • SHA512

      e8b0ab6c4d05899bafb69b11889d888c88179f62750d02088ea378dac5c763ea56f94d27af8290287a0212c17dc4d11281a7c706e6b22fbb4c5a9c6701610bc5

    • SSDEEP

      1536:O3HET0AC+nWd9hF8IkvdJQJxTrum1+oaX2QGFRQjD68a+VMKKTRVGFtUhQfR1WRw:O3DXzFev4Jx/um5aX2/eir4MKy3G7UEb

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks