Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c6d8930ea0ec173974fe33d0ed00ae7ded9a0b2eca01df4b3b84eeddd144339bN

  • Size

    52KB

  • Sample

    241014-pazmhavcqe

  • MD5

    59c26499553afc48ee90b3f845571f80

  • SHA1

    06605978e2ae031813a7edeeb98b4dce1b61b19e

  • SHA256

    c6d8930ea0ec173974fe33d0ed00ae7ded9a0b2eca01df4b3b84eeddd144339b

  • SHA512

    9b7dea0c777a723fbc7fb57d07c79cb5fde8dbbe1cd6346edad414809ca50a026c479b4e2f773f2443c077447f1482e58718abe072f4989015fe0cb79e340ca9

  • SSDEEP

    768:mh/uoOcgEZ3S6U6uEB9G5ZAVEKbBTpZd45FFgHWwj7V4kGrs/1H5F/s5MABvKWe:o+wQhqVEKTZd45FFgHWwjZ4wkMAdKZ

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      c6d8930ea0ec173974fe33d0ed00ae7ded9a0b2eca01df4b3b84eeddd144339bN

    • Size

      52KB

    • MD5

      59c26499553afc48ee90b3f845571f80

    • SHA1

      06605978e2ae031813a7edeeb98b4dce1b61b19e

    • SHA256

      c6d8930ea0ec173974fe33d0ed00ae7ded9a0b2eca01df4b3b84eeddd144339b

    • SHA512

      9b7dea0c777a723fbc7fb57d07c79cb5fde8dbbe1cd6346edad414809ca50a026c479b4e2f773f2443c077447f1482e58718abe072f4989015fe0cb79e340ca9

    • SSDEEP

      768:mh/uoOcgEZ3S6U6uEB9G5ZAVEKbBTpZd45FFgHWwj7V4kGrs/1H5F/s5MABvKWe:o+wQhqVEKTZd45FFgHWwjZ4wkMAdKZ

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks