Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4b612f56cc...bN.exe

windows7-x64

10

4b612f56cc...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b612f56ccc60fcdc2719f0bc8c5235d995068575979ef387579d59a893f60bbN

  • Size

    337KB

  • Sample

    241028-qr69caxrfl

  • MD5

    e402788ef9a92585e825bf3421ce3e50

  • SHA1

    de094a54b222787e6491b3706143db1900dd4a82

  • SHA256

    4b612f56ccc60fcdc2719f0bc8c5235d995068575979ef387579d59a893f60bb

  • SHA512

    7db6314eff4bbc897943b0393ac4036f90dbe324f359b32b2e47cd22c9d680de898708a9530e348afee788c6c5fed5f3ff17d48ab62df89d0678e9c2ee3e602a

  • SSDEEP

    3072:JNMxMLsLgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:bMKLsL1+fIyG5jZkCwi8r

Score
10/10
berbewnjratbackdoordiscoverypersistencetrojan

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      4b612f56ccc60fcdc2719f0bc8c5235d995068575979ef387579d59a893f60bbN

    • Size

      337KB

    • MD5

      e402788ef9a92585e825bf3421ce3e50

    • SHA1

      de094a54b222787e6491b3706143db1900dd4a82

    • SHA256

      4b612f56ccc60fcdc2719f0bc8c5235d995068575979ef387579d59a893f60bb

    • SHA512

      7db6314eff4bbc897943b0393ac4036f90dbe324f359b32b2e47cd22c9d680de898708a9530e348afee788c6c5fed5f3ff17d48ab62df89d0678e9c2ee3e602a

    • SSDEEP

      3072:JNMxMLsLgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:bMKLsL1+fIyG5jZkCwi8r

    Score
    10/10
    berbewnjratbackdoordiscoverypersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.