Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d4e7453d56...3N.exe

windows7-x64

10

d4e7453d56...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4e7453d5600b24a888a22197e770e6280c458b778fb65433a84e30f46f7cc93N

  • Size

    96KB

  • Sample

    241012-ymfjtsydnb

  • MD5

    5ac720f9c14f20306850eb45cd29f020

  • SHA1

    2149634192c90aff04374bc31c2b1002e05dac7f

  • SHA256

    d4e7453d5600b24a888a22197e770e6280c458b778fb65433a84e30f46f7cc93

  • SHA512

    c60877cb15e4245ddca25cd507325d6cbcfec4ae5216ca23d5f5121b436f9f3e383b848a6ef50a2d231f9a69d1a628635c47d332c08390d5fee2858fbbb32465

  • SSDEEP

    1536:IO3L98hh69AFOlIqZq/VdXScUdmbwTrYNRy/BOmQCMy0QiLiizHNQNdq:IdhhWZKJPw00n5OmQCMyELiAHONdq

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d4e7453d5600b24a888a22197e770e6280c458b778fb65433a84e30f46f7cc93N

    • Size

      96KB

    • MD5

      5ac720f9c14f20306850eb45cd29f020

    • SHA1

      2149634192c90aff04374bc31c2b1002e05dac7f

    • SHA256

      d4e7453d5600b24a888a22197e770e6280c458b778fb65433a84e30f46f7cc93

    • SHA512

      c60877cb15e4245ddca25cd507325d6cbcfec4ae5216ca23d5f5121b436f9f3e383b848a6ef50a2d231f9a69d1a628635c47d332c08390d5fee2858fbbb32465

    • SSDEEP

      1536:IO3L98hh69AFOlIqZq/VdXScUdmbwTrYNRy/BOmQCMy0QiLiizHNQNdq:IdhhWZKJPw00n5OmQCMyELiAHONdq

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks