Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8c711a2ca7...aN.exe

windows7-x64

10

8c711a2ca7...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c711a2ca7852eeaa1033e616182f9ff5437166cf04dad0cec3cda74fd2ec8caN

  • Size

    64KB

  • Sample

    241012-ldr52stdjf

  • MD5

    41d8b6b11245c7b4cefa802f5f5ca910

  • SHA1

    290a168df6305ca16760d9d70e9cb6a6bab89b46

  • SHA256

    8c711a2ca7852eeaa1033e616182f9ff5437166cf04dad0cec3cda74fd2ec8ca

  • SHA512

    0d756555b2725b7bdfb0013d7a8eaf5ea63755959ffe6671d802da4e1042d3e56f8aec19526c32c926d9a63e65c0778d2184db826110e606d25ffce8419b8d61

  • SSDEEP

    1536:W3A7EfqN4o1k/cWaoEUoVNbdA2xciZV1iL+iALMH6:W3ECqmoXoEfNyyZV1iL+9Ma

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      8c711a2ca7852eeaa1033e616182f9ff5437166cf04dad0cec3cda74fd2ec8caN

    • Size

      64KB

    • MD5

      41d8b6b11245c7b4cefa802f5f5ca910

    • SHA1

      290a168df6305ca16760d9d70e9cb6a6bab89b46

    • SHA256

      8c711a2ca7852eeaa1033e616182f9ff5437166cf04dad0cec3cda74fd2ec8ca

    • SHA512

      0d756555b2725b7bdfb0013d7a8eaf5ea63755959ffe6671d802da4e1042d3e56f8aec19526c32c926d9a63e65c0778d2184db826110e606d25ffce8419b8d61

    • SSDEEP

      1536:W3A7EfqN4o1k/cWaoEUoVNbdA2xciZV1iL+iALMH6:W3ECqmoXoEfNyyZV1iL+9Ma

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks