Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2931c2d2e525c9d980fc28b98d64a84dd32567395074ba9988f120da0b740b31N

  • Size

    67KB

  • Sample

    241003-xleqga1ekn

  • MD5

    b92bfdff4e0eb705a170f6873a593050

  • SHA1

    f0509016991a8c5e1ed1356f551df0c31018963e

  • SHA256

    2931c2d2e525c9d980fc28b98d64a84dd32567395074ba9988f120da0b740b31

  • SHA512

    dcf94866f4ebd78ea37d54b7ec02c9788a7c21278db988323f99698ec5353239063a5b92150d4266104eb26f303c509678c5d9c136bdabe2c1a2d9f0cc85a953

  • SSDEEP

    1536:46zl48VIKBZh9XFyeTpsJifTduD4oTxw:jzl48JXTpsJibdMTxw

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      2931c2d2e525c9d980fc28b98d64a84dd32567395074ba9988f120da0b740b31N

    • Size

      67KB

    • MD5

      b92bfdff4e0eb705a170f6873a593050

    • SHA1

      f0509016991a8c5e1ed1356f551df0c31018963e

    • SHA256

      2931c2d2e525c9d980fc28b98d64a84dd32567395074ba9988f120da0b740b31

    • SHA512

      dcf94866f4ebd78ea37d54b7ec02c9788a7c21278db988323f99698ec5353239063a5b92150d4266104eb26f303c509678c5d9c136bdabe2c1a2d9f0cc85a953

    • SSDEEP

      1536:46zl48VIKBZh9XFyeTpsJifTduD4oTxw:jzl48JXTpsJibdMTxw

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks