Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

82e9cb33e2...7N.exe

windows7-x64

10

82e9cb33e2...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82e9cb33e2b24d4d512a87d4fb38be2f212b07a0b140b9ee1b14195c91460dd7N

  • Size

    117KB

  • Sample

    241014-ejh11axhpd

  • MD5

    bce4008f44a066830c060bf880628570

  • SHA1

    c8004b3a95453850bc846506597986955f458627

  • SHA256

    82e9cb33e2b24d4d512a87d4fb38be2f212b07a0b140b9ee1b14195c91460dd7

  • SHA512

    c82a795587e382e7e38a69be8c2d18f71c7fed97dff1f515e7496db1e070e11df366a121ee85c62e0928d762c81e056a639ebcd4df038ccf87ad7d4fe4a77f62

  • SSDEEP

    3072:q0KJsVk78HLIgVXqvDeLoZKMNYP55FFfUrQlM:xKJsV5sgVQ9zNYP55TfMQ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      82e9cb33e2b24d4d512a87d4fb38be2f212b07a0b140b9ee1b14195c91460dd7N

    • Size

      117KB

    • MD5

      bce4008f44a066830c060bf880628570

    • SHA1

      c8004b3a95453850bc846506597986955f458627

    • SHA256

      82e9cb33e2b24d4d512a87d4fb38be2f212b07a0b140b9ee1b14195c91460dd7

    • SHA512

      c82a795587e382e7e38a69be8c2d18f71c7fed97dff1f515e7496db1e070e11df366a121ee85c62e0928d762c81e056a639ebcd4df038ccf87ad7d4fe4a77f62

    • SSDEEP

      3072:q0KJsVk78HLIgVXqvDeLoZKMNYP55FFfUrQlM:xKJsV5sgVQ9zNYP55TfMQ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks