Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4a3a4ff605c9fde5cb8653723ef83a3ba54e6a82956dcb0441c29035660471b5N

  • Size

    59KB

  • Sample

    241008-z6ex3sxenm

  • MD5

    0e904fba16ccd18b2ac6f4e97ae08180

  • SHA1

    1a605733d1bb98e0b2c9087fb468ce4b7f9cd62f

  • SHA256

    4a3a4ff605c9fde5cb8653723ef83a3ba54e6a82956dcb0441c29035660471b5

  • SHA512

    6831905d48168089232c984b5e33205a339e803bdce274388fe850625aaba324dd877f250c091dd5aa1969b040a22f26793fbe14829603efac215c084573b3e4

  • SSDEEP

    768:mbps76m0X43/KRVTrkbPYZoujbjReue/gRZ/1H50l5nf1fZMEBFELvkVgFRo:mb6uP43SPT+MoujRggp6PNCyVso

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      4a3a4ff605c9fde5cb8653723ef83a3ba54e6a82956dcb0441c29035660471b5N

    • Size

      59KB

    • MD5

      0e904fba16ccd18b2ac6f4e97ae08180

    • SHA1

      1a605733d1bb98e0b2c9087fb468ce4b7f9cd62f

    • SHA256

      4a3a4ff605c9fde5cb8653723ef83a3ba54e6a82956dcb0441c29035660471b5

    • SHA512

      6831905d48168089232c984b5e33205a339e803bdce274388fe850625aaba324dd877f250c091dd5aa1969b040a22f26793fbe14829603efac215c084573b3e4

    • SSDEEP

      768:mbps76m0X43/KRVTrkbPYZoujbjReue/gRZ/1H50l5nf1fZMEBFELvkVgFRo:mb6uP43SPT+MoujRggp6PNCyVso

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks