Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

dd5b840ef5...8N.exe

windows7-x64

10

dd5b840ef5...8N.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd5b840ef5f6a9d8240d52c17ed39d518c81550ea5549201a7cf052446284c98N

  • Size

    80KB

  • Sample

    241004-t4t2bsyfrh

  • MD5

    c9132cf2c45e4053818eb7aa7d31c8e0

  • SHA1

    0d157d40b277dd7a05a60918bcc0cf31a6881a6a

  • SHA256

    dd5b840ef5f6a9d8240d52c17ed39d518c81550ea5549201a7cf052446284c98

  • SHA512

    9feffaf95630b3c794d405716ed29213e9fc85cfa91f5197a6ba923f87a13b71e2f51f7362cf9c5bcf2f1a0460348acd97dc378092b4bb5b8e2a80e53827446d

  • SSDEEP

    1536:A8qPq3vRSFWTjW9UfZiD10E7zIzLjRQAARJJ5R2xOSC4BG:9ZS89fZiD1V7UzfePrJ5wxO344

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      dd5b840ef5f6a9d8240d52c17ed39d518c81550ea5549201a7cf052446284c98N

    • Size

      80KB

    • MD5

      c9132cf2c45e4053818eb7aa7d31c8e0

    • SHA1

      0d157d40b277dd7a05a60918bcc0cf31a6881a6a

    • SHA256

      dd5b840ef5f6a9d8240d52c17ed39d518c81550ea5549201a7cf052446284c98

    • SHA512

      9feffaf95630b3c794d405716ed29213e9fc85cfa91f5197a6ba923f87a13b71e2f51f7362cf9c5bcf2f1a0460348acd97dc378092b4bb5b8e2a80e53827446d

    • SSDEEP

      1536:A8qPq3vRSFWTjW9UfZiD10E7zIzLjRQAARJJ5R2xOSC4BG:9ZS89fZiD1V7UzfePrJ5wxO344

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks