Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a8d716d1d0...0N.exe

windows7-x64

10

a8d716d1d0...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8d716d1d0d9142a581d9bdf9a41432a29760882ce1456c50439c68690db4120N

  • Size

    148KB

  • Sample

    241001-2ewsmatdlq

  • MD5

    fe0adf45cc1fbc4ef5d66fa09c7309b0

  • SHA1

    28ff9c37d78fb5ede34b07d186390e09697e6a35

  • SHA256

    a8d716d1d0d9142a581d9bdf9a41432a29760882ce1456c50439c68690db4120

  • SHA512

    38fea3d836f1cdf44bc0ef452bc734e26f59f77701b779285435b42f56374eae5511468ecb04f146e8585f79f6dcc34079a2618a19ed0a697abfbf0e7e541391

  • SSDEEP

    3072:uG9EYwxdUY5OdzOdjKtlDoNQQ9wlHOdj+UCRQKOdj+U:u85wxdUKOdzOdkOdezOd

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      a8d716d1d0d9142a581d9bdf9a41432a29760882ce1456c50439c68690db4120N

    • Size

      148KB

    • MD5

      fe0adf45cc1fbc4ef5d66fa09c7309b0

    • SHA1

      28ff9c37d78fb5ede34b07d186390e09697e6a35

    • SHA256

      a8d716d1d0d9142a581d9bdf9a41432a29760882ce1456c50439c68690db4120

    • SHA512

      38fea3d836f1cdf44bc0ef452bc734e26f59f77701b779285435b42f56374eae5511468ecb04f146e8585f79f6dcc34079a2618a19ed0a697abfbf0e7e541391

    • SSDEEP

      3072:uG9EYwxdUY5OdzOdjKtlDoNQQ9wlHOdj+UCRQKOdj+U:u85wxdUKOdzOdkOdezOd

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.