Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0020791585...4N.exe

windows7-x64

10

0020791585...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0020791585d05effb8d9f9d4707ce566d43305ff5731ba1b3ee1b124536e97a4N.exe

  • Size

    448KB

  • Sample

    241208-csq2vsxkhz

  • MD5

    77bff3fb105bc5a49a61bb93e7cbb4d0

  • SHA1

    b85ce8a263cf6ded9f06fc11af58425bce24dec7

  • SHA256

    0020791585d05effb8d9f9d4707ce566d43305ff5731ba1b3ee1b124536e97a4

  • SHA512

    9399456b9e212296b7f9792bf79b25479c5f6cc42c9326b833a9cda97707b39c1c11fe74494720d2fe35941c6567dcb25939b0a138e228c76b420335e75794e3

  • SSDEEP

    6144:NR9B/MwGsmLrZNs/VKi/MwGsmLr5+Nod/MwGsmLrZNs/VKi/MwGsmLrRo6+:/zMmmpNs/VXMmmg8MmmpNs/VXMmmA

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      0020791585d05effb8d9f9d4707ce566d43305ff5731ba1b3ee1b124536e97a4N.exe

    • Size

      448KB

    • MD5

      77bff3fb105bc5a49a61bb93e7cbb4d0

    • SHA1

      b85ce8a263cf6ded9f06fc11af58425bce24dec7

    • SHA256

      0020791585d05effb8d9f9d4707ce566d43305ff5731ba1b3ee1b124536e97a4

    • SHA512

      9399456b9e212296b7f9792bf79b25479c5f6cc42c9326b833a9cda97707b39c1c11fe74494720d2fe35941c6567dcb25939b0a138e228c76b420335e75794e3

    • SSDEEP

      6144:NR9B/MwGsmLrZNs/VKi/MwGsmLr5+Nod/MwGsmLrZNs/VKi/MwGsmLrRo6+:/zMmmpNs/VXMmmg8MmmpNs/VXMmmA

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.