Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    30e7973239e35fe6c1e28d5bb0dada8c27dd2a05a43faae5865adddf7044740f

  • Size

    63KB

  • Sample

    241017-ypa25atbja

  • MD5

    bce45157e860954b21bcf658a63170d3

  • SHA1

    a366b2dc9b9ca9ee950c3940bf6fbbc8496990db

  • SHA256

    30e7973239e35fe6c1e28d5bb0dada8c27dd2a05a43faae5865adddf7044740f

  • SHA512

    02e414fb1a5984a0016e1ef8d0e441c53250630bbb6cbe41672a42f1922607d576530dc95c0fc58b39671f639787d70005b0ce666eda74f150898d80bd11f137

  • SSDEEP

    1536:DgE+Ef7lENCvcJT+2rvMgPR7B5miAXAck+V03En9rjDHE:DFVfpENMcJT+2rvMgPVUkoKk9DHE

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      30e7973239e35fe6c1e28d5bb0dada8c27dd2a05a43faae5865adddf7044740f

    • Size

      63KB

    • MD5

      bce45157e860954b21bcf658a63170d3

    • SHA1

      a366b2dc9b9ca9ee950c3940bf6fbbc8496990db

    • SHA256

      30e7973239e35fe6c1e28d5bb0dada8c27dd2a05a43faae5865adddf7044740f

    • SHA512

      02e414fb1a5984a0016e1ef8d0e441c53250630bbb6cbe41672a42f1922607d576530dc95c0fc58b39671f639787d70005b0ce666eda74f150898d80bd11f137

    • SSDEEP

      1536:DgE+Ef7lENCvcJT+2rvMgPR7B5miAXAck+V03En9rjDHE:DFVfpENMcJT+2rvMgPVUkoKk9DHE

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks