Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

7abd6b7d98...5N.exe

windows7-x64

10

7abd6b7d98...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7abd6b7d983149ea1711fe72c19fab3a551858175a4cf325560fc54c21fc6585N

  • Size

    71KB

  • Sample

    240928-pm43raycmb

  • MD5

    bf942094c936904cbe4953c2c83f2c70

  • SHA1

    96204e409b41afa584aabf324c942081c7434439

  • SHA256

    7abd6b7d983149ea1711fe72c19fab3a551858175a4cf325560fc54c21fc6585

  • SHA512

    d89e9df1c7d0b1931297b1edb46f038c9af34f8767e4557afc87bf08cd88833ae0bc24cd14e69fa3f31c82b9fd9eac17066d8fcc05a67a0697005489d19d43f0

  • SSDEEP

    1536:xQnxsnOhyc2N7YmZiafom3yIOToqFA2LZ7RZObZUS:xQnWcSZiaf93w0CZClUS

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      7abd6b7d983149ea1711fe72c19fab3a551858175a4cf325560fc54c21fc6585N

    • Size

      71KB

    • MD5

      bf942094c936904cbe4953c2c83f2c70

    • SHA1

      96204e409b41afa584aabf324c942081c7434439

    • SHA256

      7abd6b7d983149ea1711fe72c19fab3a551858175a4cf325560fc54c21fc6585

    • SHA512

      d89e9df1c7d0b1931297b1edb46f038c9af34f8767e4557afc87bf08cd88833ae0bc24cd14e69fa3f31c82b9fd9eac17066d8fcc05a67a0697005489d19d43f0

    • SSDEEP

      1536:xQnxsnOhyc2N7YmZiafom3yIOToqFA2LZ7RZObZUS:xQnWcSZiaf93w0CZClUS

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.