Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    de18fbd6204a2aec31ef5a8ce0b432f8908c6325867ead95dd9243a13ee270b0N

  • Size

    97KB

  • Sample

    241001-b5swjsyflh

  • MD5

    61fa00491630486e34c9ce0d2b869ec0

  • SHA1

    1378aaec93bf94e17227fd6e45bf3926ecb59730

  • SHA256

    de18fbd6204a2aec31ef5a8ce0b432f8908c6325867ead95dd9243a13ee270b0

  • SHA512

    1c804a77fac01f030093ef3383cdf679b49d14af77a56e93016f12866ce16c00cf73d1c3c54087fe61e318accd2e771d3c2591e8e115352ac0efbe2789ac09bd

  • SSDEEP

    3072:guFUw94jwECmqbqzFy+6pbruv/JaPzwm7pJXeK6:p9gCmm4IuZwz/7zeX

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      de18fbd6204a2aec31ef5a8ce0b432f8908c6325867ead95dd9243a13ee270b0N

    • Size

      97KB

    • MD5

      61fa00491630486e34c9ce0d2b869ec0

    • SHA1

      1378aaec93bf94e17227fd6e45bf3926ecb59730

    • SHA256

      de18fbd6204a2aec31ef5a8ce0b432f8908c6325867ead95dd9243a13ee270b0

    • SHA512

      1c804a77fac01f030093ef3383cdf679b49d14af77a56e93016f12866ce16c00cf73d1c3c54087fe61e318accd2e771d3c2591e8e115352ac0efbe2789ac09bd

    • SSDEEP

      3072:guFUw94jwECmqbqzFy+6pbruv/JaPzwm7pJXeK6:p9gCmm4IuZwz/7zeX

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.