Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    781e3354300764889d0af7015d98e7362c9a761f09c9a3dc7d74580beef91703N.exe

  • Size

    96KB

  • Sample

    241127-t8wqqaxqfn

  • MD5

    9f0dc52df399f7f32cb2c1c8cae6f2f0

  • SHA1

    9dbeae07adb8daccdc6cd9c1d66c0e6af891601b

  • SHA256

    781e3354300764889d0af7015d98e7362c9a761f09c9a3dc7d74580beef91703

  • SHA512

    270c7e56c8b308a277f827ee1fa1b93e54a7a3b2f17a61a0d4e475190f7f9bfbb2b40c469465cfc0d684cbe0343fd12ce6b02ae8af6d7f305af1a0b30124d8ab

  • SSDEEP

    1536:itr5iRVqVaw62hTQri9luXWSvZ2L27RZObZUUWaegPYA:Qr5mVqVtzh0ri9lumsS2ClUUWae

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      781e3354300764889d0af7015d98e7362c9a761f09c9a3dc7d74580beef91703N.exe

    • Size

      96KB

    • MD5

      9f0dc52df399f7f32cb2c1c8cae6f2f0

    • SHA1

      9dbeae07adb8daccdc6cd9c1d66c0e6af891601b

    • SHA256

      781e3354300764889d0af7015d98e7362c9a761f09c9a3dc7d74580beef91703

    • SHA512

      270c7e56c8b308a277f827ee1fa1b93e54a7a3b2f17a61a0d4e475190f7f9bfbb2b40c469465cfc0d684cbe0343fd12ce6b02ae8af6d7f305af1a0b30124d8ab

    • SSDEEP

      1536:itr5iRVqVaw62hTQri9luXWSvZ2L27RZObZUUWaegPYA:Qr5mVqVtzh0ri9lumsS2ClUUWae

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

    • Bruteratel family

    • Detect BruteRatel badger

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.