Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4a203070c8...7N.exe

windows7-x64

10

4a203070c8...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a203070c86fb9d9b2ad82ca4371c8f16d08b464d35ddb053775fb4371ee9fb7N.exe

  • Size

    55KB

  • Sample

    241207-2l7hpstjam

  • MD5

    45e08a48f78417e48181371566bf7c10

  • SHA1

    e3322b0b397adb0f9f8682d0d44f2d1db6c4f5b4

  • SHA256

    4a203070c86fb9d9b2ad82ca4371c8f16d08b464d35ddb053775fb4371ee9fb7

  • SHA512

    cb511e214b5bb8edcc7bfe5c69f430ebd95cbedb048c44e506e90ff15f69298cd9dd1dc3d2bfe768b60a06fb69865d66ae5ae11a3ae027e552c426203e7d386c

  • SSDEEP

    768:0g6ps7DLK89kd9cqvAJUchB8n8r61Xz+fAf9vSWw3cNqMqf/1H5UXdnhKG:0rsTKHCGAbB88G1Xz+fAf9vw3cYvlAn

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      4a203070c86fb9d9b2ad82ca4371c8f16d08b464d35ddb053775fb4371ee9fb7N.exe

    • Size

      55KB

    • MD5

      45e08a48f78417e48181371566bf7c10

    • SHA1

      e3322b0b397adb0f9f8682d0d44f2d1db6c4f5b4

    • SHA256

      4a203070c86fb9d9b2ad82ca4371c8f16d08b464d35ddb053775fb4371ee9fb7

    • SHA512

      cb511e214b5bb8edcc7bfe5c69f430ebd95cbedb048c44e506e90ff15f69298cd9dd1dc3d2bfe768b60a06fb69865d66ae5ae11a3ae027e552c426203e7d386c

    • SSDEEP

      768:0g6ps7DLK89kd9cqvAJUchB8n8r61Xz+fAf9vSWw3cNqMqf/1H5UXdnhKG:0rsTKHCGAbB88G1Xz+fAf9vw3cYvlAn

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks