Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

fb29b9cfae...99.exe

windows7-x64

10

fb29b9cfae...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb29b9cfae0ad6677b893769f0dd9a404194fa1adfbed4f7746c0c23fa583599

  • Size

    64KB

  • Sample

    241018-fpca3syejf

  • MD5

    b5201e93d61d7ec675b54aa6e39fcaf4

  • SHA1

    e12fd92661a48574af71355499f510cd37ffe8ad

  • SHA256

    fb29b9cfae0ad6677b893769f0dd9a404194fa1adfbed4f7746c0c23fa583599

  • SHA512

    9e04b133c342f3668194f81390b8887239a5722225646346cd98fb127cca97931031aac623b8aa178812fb69ae0734ca1e371ecc1a36b0881866963f15a4b618

  • SSDEEP

    1536:Pwi1i9rE+4V9UV/9FQ84swcY3IUQ84EAso0wcYkgMIUQ84EAso0wcYkgMIUQ84E5:Xi9rB4vU50vlWY/m0Z

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      fb29b9cfae0ad6677b893769f0dd9a404194fa1adfbed4f7746c0c23fa583599

    • Size

      64KB

    • MD5

      b5201e93d61d7ec675b54aa6e39fcaf4

    • SHA1

      e12fd92661a48574af71355499f510cd37ffe8ad

    • SHA256

      fb29b9cfae0ad6677b893769f0dd9a404194fa1adfbed4f7746c0c23fa583599

    • SHA512

      9e04b133c342f3668194f81390b8887239a5722225646346cd98fb127cca97931031aac623b8aa178812fb69ae0734ca1e371ecc1a36b0881866963f15a4b618

    • SSDEEP

      1536:Pwi1i9rE+4V9UV/9FQ84swcY3IUQ84EAso0wcYkgMIUQ84EAso0wcYkgMIUQ84E5:Xi9rB4vU50vlWY/m0Z

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.