Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    713f5ea6df5dc0565860623550a1aab39b3e0ff09c7de8cae14db7915dd1a127.exe

  • Size

    97KB

  • Sample

    241222-pm4rzsyldp

  • MD5

    693d84a5e85a67e5d32977281af24ca2

  • SHA1

    bf445466b157cc729cbf6f613fc66ccd5aeb5bf1

  • SHA256

    713f5ea6df5dc0565860623550a1aab39b3e0ff09c7de8cae14db7915dd1a127

  • SHA512

    3d3c884118dbe392420c25c007de30b0d47474302970cd16afbb27dfd05ec4fce102c87ed3820aa71e183e6c686840c7d49e193e20ff5d6d6f2bad292530c0a8

  • SSDEEP

    1536:3c30ExBEg2QF9Sd/D58rQ/04lMTgfPQzXUwXfzwE57pvJXeYZQ:3wBEg/FG/D588/0KMkfY3Pzwm7pJXeKQ

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      713f5ea6df5dc0565860623550a1aab39b3e0ff09c7de8cae14db7915dd1a127.exe

    • Size

      97KB

    • MD5

      693d84a5e85a67e5d32977281af24ca2

    • SHA1

      bf445466b157cc729cbf6f613fc66ccd5aeb5bf1

    • SHA256

      713f5ea6df5dc0565860623550a1aab39b3e0ff09c7de8cae14db7915dd1a127

    • SHA512

      3d3c884118dbe392420c25c007de30b0d47474302970cd16afbb27dfd05ec4fce102c87ed3820aa71e183e6c686840c7d49e193e20ff5d6d6f2bad292530c0a8

    • SSDEEP

      1536:3c30ExBEg2QF9Sd/D58rQ/04lMTgfPQzXUwXfzwE57pvJXeYZQ:3wBEg/FG/D588/0KMkfY3Pzwm7pJXeKQ

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks