Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f4ad90110b...de.exe

windows7-x64

10

f4ad90110b...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4ad90110bee0cf8b18127f11201aec61ad6f2f9204f347fe696a508c259a5de

  • Size

    94KB

  • Sample

    241010-dxfmcswfpd

  • MD5

    b066567871677d615a9a55d6c516a4c6

  • SHA1

    222c08e0dc45b4341c9f51584635316cf709bdf0

  • SHA256

    f4ad90110bee0cf8b18127f11201aec61ad6f2f9204f347fe696a508c259a5de

  • SHA512

    6a8a46054f536dfd8a40383e808a1269f5609be6b56745d5ff5c552c7877a85b15098e4c8ec00dc4cc2784cca889b5e871318cb070a0c0e657d3622814ed30a0

  • SSDEEP

    1536:hucX3be43JFzg3P26Fe8sHslk8/DGIQ0LPOuIFWfRQD5DRfRa9HprmRfRZ:tCwi3P2W/sGkncSWfeDF5wkpv

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f4ad90110bee0cf8b18127f11201aec61ad6f2f9204f347fe696a508c259a5de

    • Size

      94KB

    • MD5

      b066567871677d615a9a55d6c516a4c6

    • SHA1

      222c08e0dc45b4341c9f51584635316cf709bdf0

    • SHA256

      f4ad90110bee0cf8b18127f11201aec61ad6f2f9204f347fe696a508c259a5de

    • SHA512

      6a8a46054f536dfd8a40383e808a1269f5609be6b56745d5ff5c552c7877a85b15098e4c8ec00dc4cc2784cca889b5e871318cb070a0c0e657d3622814ed30a0

    • SSDEEP

      1536:hucX3be43JFzg3P26Fe8sHslk8/DGIQ0LPOuIFWfRQD5DRfRa9HprmRfRZ:tCwi3P2W/sGkncSWfeDF5wkpv

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks