Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    203ec621c4796d12209b55e2018111cf04631843ff29d93bafc7f42fd80a2d2a

  • Size

    128KB

  • Sample

    240928-x99krasgmn

  • MD5

    ae1ab3a5cf067a86f2705bfa0094ccde

  • SHA1

    580ec9f8b4bfa35114e32f388c06774980f702b6

  • SHA256

    203ec621c4796d12209b55e2018111cf04631843ff29d93bafc7f42fd80a2d2a

  • SHA512

    471b13862d93453312439d8af7bcc7dac7f8f820f62992e0e16f3f794e262c63340fd3a0f04d27ece048766ed78e0a62079b8dfc716ad717c23025984bddd0d2

  • SSDEEP

    3072:WXf6l9l/NcDrFDHZtOgxBOXXwwfBoD6N3h8N5Gg:WXfON85tTDUZNSN57

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      203ec621c4796d12209b55e2018111cf04631843ff29d93bafc7f42fd80a2d2a

    • Size

      128KB

    • MD5

      ae1ab3a5cf067a86f2705bfa0094ccde

    • SHA1

      580ec9f8b4bfa35114e32f388c06774980f702b6

    • SHA256

      203ec621c4796d12209b55e2018111cf04631843ff29d93bafc7f42fd80a2d2a

    • SHA512

      471b13862d93453312439d8af7bcc7dac7f8f820f62992e0e16f3f794e262c63340fd3a0f04d27ece048766ed78e0a62079b8dfc716ad717c23025984bddd0d2

    • SSDEEP

      3072:WXf6l9l/NcDrFDHZtOgxBOXXwwfBoD6N3h8N5Gg:WXfON85tTDUZNSN57

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks