Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1e82524f8aafb73c6b0777bddb36ce164304421765650b0cfb141744144cdde6.exe

  • Size

    45KB

  • Sample

    241222-ns91hsxjhq

  • MD5

    854b067e76def63af2276acc43919a35

  • SHA1

    c1d782951212e3c3bea55fee6df2c8e64bda42a1

  • SHA256

    1e82524f8aafb73c6b0777bddb36ce164304421765650b0cfb141744144cdde6

  • SHA512

    894e1cbab7035e9c1cb01f8470f9d0251a8a733d99b084f271a469062b707b7af559f522bc999e93c2cc3e7b4bcf59b5ff49319f9e4b3e05c355144de4902a44

  • SSDEEP

    768:l4ScTwSb1E9X7W9vjo5EI/zc6BRdzVgF/1H5d:l4ScESb+s72U6pkn

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      1e82524f8aafb73c6b0777bddb36ce164304421765650b0cfb141744144cdde6.exe

    • Size

      45KB

    • MD5

      854b067e76def63af2276acc43919a35

    • SHA1

      c1d782951212e3c3bea55fee6df2c8e64bda42a1

    • SHA256

      1e82524f8aafb73c6b0777bddb36ce164304421765650b0cfb141744144cdde6

    • SHA512

      894e1cbab7035e9c1cb01f8470f9d0251a8a733d99b084f271a469062b707b7af559f522bc999e93c2cc3e7b4bcf59b5ff49319f9e4b3e05c355144de4902a44

    • SSDEEP

      768:l4ScTwSb1E9X7W9vjo5EI/zc6BRdzVgF/1H5d:l4ScESb+s72U6pkn

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks