Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0c89aed92d...60.exe

windows7-x64

10

0c89aed92d...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c89aed92d6901ef05abd23838bbc2e4f88272f128fa28f65727ca5c8c7b6260.exe

  • Size

    93KB

  • Sample

    241211-bqvftstkdl

  • MD5

    ba4824040906d96c4002eaca3441c270

  • SHA1

    c335f79480190863a946e12935d1d330c3582b33

  • SHA256

    0c89aed92d6901ef05abd23838bbc2e4f88272f128fa28f65727ca5c8c7b6260

  • SHA512

    f3d9ec7b08fafca865099730ec73f5a2d1c455ba10bfc77c396af2759c54cafdbb87f7dd92baa451786ee9f1e5348cc1d1ea374c2688841391ae9e1583f5de2b

  • SSDEEP

    1536:KB7fYbUFcJXFZYoWQen/oh5Kl3Tnh1DaYfMZRWuLsV+1Z:KBFSJ/mohIxjhgYfc0DV+1Z

Score
10/10
berbewnjratbackdoordiscoverypersistencetrojan

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      0c89aed92d6901ef05abd23838bbc2e4f88272f128fa28f65727ca5c8c7b6260.exe

    • Size

      93KB

    • MD5

      ba4824040906d96c4002eaca3441c270

    • SHA1

      c335f79480190863a946e12935d1d330c3582b33

    • SHA256

      0c89aed92d6901ef05abd23838bbc2e4f88272f128fa28f65727ca5c8c7b6260

    • SHA512

      f3d9ec7b08fafca865099730ec73f5a2d1c455ba10bfc77c396af2759c54cafdbb87f7dd92baa451786ee9f1e5348cc1d1ea374c2688841391ae9e1583f5de2b

    • SSDEEP

      1536:KB7fYbUFcJXFZYoWQen/oh5Kl3Tnh1DaYfMZRWuLsV+1Z:KBFSJ/mohIxjhgYfc0DV+1Z

    Score
    10/10
    berbewnjratbackdoordiscoverypersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.