Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    87d9fcaa7eb40de49984736df0cf4f9be6fa6adf1ab5b591ccf5f841610e83a4N.exe

  • Size

    163KB

  • Sample

    241202-b5n8csxrgn

  • MD5

    e1d2e397cce23871d6800f0131836900

  • SHA1

    ad38e84a0906be2ab26336c3fcdfa906c339263e

  • SHA256

    87d9fcaa7eb40de49984736df0cf4f9be6fa6adf1ab5b591ccf5f841610e83a4

  • SHA512

    c042027335b5d368765be502162774461d951a200916ceb13e742623d507e3f83f077356fe44a4369997146639c54f54017edda20e993fcdc978b7d8f5a20a20

  • SSDEEP

    1536:PzFUEg/T48+taofUtZkJlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Bk/c8+4yUt2JltOrWKDBr+yJb

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Targets

    • Target

      87d9fcaa7eb40de49984736df0cf4f9be6fa6adf1ab5b591ccf5f841610e83a4N.exe

    • Size

      163KB

    • MD5

      e1d2e397cce23871d6800f0131836900

    • SHA1

      ad38e84a0906be2ab26336c3fcdfa906c339263e

    • SHA256

      87d9fcaa7eb40de49984736df0cf4f9be6fa6adf1ab5b591ccf5f841610e83a4

    • SHA512

      c042027335b5d368765be502162774461d951a200916ceb13e742623d507e3f83f077356fe44a4369997146639c54f54017edda20e993fcdc978b7d8f5a20a20

    • SSDEEP

      1536:PzFUEg/T48+taofUtZkJlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Bk/c8+4yUt2JltOrWKDBr+yJb

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

    • Bruteratel family

    • Detect BruteRatel badger

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.