Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0538a727d2...9N.exe

windows7-x64

10

0538a727d2...9N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0538a727d268a6dbcf20b7892494238c9e12b95a5a5a5179596e9a9fd9c36f69N

  • Size

    96KB

  • Sample

    241001-v9c6fascpk

  • MD5

    10a5104a95b119e3aa716c79decae7e0

  • SHA1

    c3d7ad6ac595b0084242cfa7ac7330b0f3e2e1ad

  • SHA256

    0538a727d268a6dbcf20b7892494238c9e12b95a5a5a5179596e9a9fd9c36f69

  • SHA512

    3748f7fe9ed2ddb99cc3fc2c3b395c62bb0baf7c0a3f5909e8507c51b82fc8a34eea773e002a8973065e244effb79be331df9ad6efbb7c4512ff55233a3f1484

  • SSDEEP

    1536:oWEoa/VGlW3SaqsG2nBUibh2qTPAbRx2xQttPeduV9jojTIvjrH:/E3ZCa/G2FTPAb2xQtBed69jc0vf

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0538a727d268a6dbcf20b7892494238c9e12b95a5a5a5179596e9a9fd9c36f69N

    • Size

      96KB

    • MD5

      10a5104a95b119e3aa716c79decae7e0

    • SHA1

      c3d7ad6ac595b0084242cfa7ac7330b0f3e2e1ad

    • SHA256

      0538a727d268a6dbcf20b7892494238c9e12b95a5a5a5179596e9a9fd9c36f69

    • SHA512

      3748f7fe9ed2ddb99cc3fc2c3b395c62bb0baf7c0a3f5909e8507c51b82fc8a34eea773e002a8973065e244effb79be331df9ad6efbb7c4512ff55233a3f1484

    • SSDEEP

      1536:oWEoa/VGlW3SaqsG2nBUibh2qTPAbRx2xQttPeduV9jojTIvjrH:/E3ZCa/G2FTPAb2xQtBed69jc0vf

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks