Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1a0afd975265caf2ff84495101508504fe6d8d010fe63ac4ad04ec6b6d1438c6

  • Size

    92KB

  • Sample

    241222-yx5lpsxrfn

  • MD5

    fe6566fd358f4bc76b016fbd7d469145

  • SHA1

    a04ca4beac9ca9233b221ce7513fee8867905c9b

  • SHA256

    1a0afd975265caf2ff84495101508504fe6d8d010fe63ac4ad04ec6b6d1438c6

  • SHA512

    1e7594d81326382953be80bd338441b564ea64a60c32d224b3a6d505f18515e64d9ec6053a078b5d6d74941c6417849f41507b87f800f34e276aab4a998d36ea

  • SSDEEP

    1536:TtZI/EFAt9W3bmSuhLRS6r5JZM000000xoXwakywkdQO6nKQrUoR24HsUs:YcFAtVxlS4ZM000000xxaRwk2U6THsR

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      1a0afd975265caf2ff84495101508504fe6d8d010fe63ac4ad04ec6b6d1438c6

    • Size

      92KB

    • MD5

      fe6566fd358f4bc76b016fbd7d469145

    • SHA1

      a04ca4beac9ca9233b221ce7513fee8867905c9b

    • SHA256

      1a0afd975265caf2ff84495101508504fe6d8d010fe63ac4ad04ec6b6d1438c6

    • SHA512

      1e7594d81326382953be80bd338441b564ea64a60c32d224b3a6d505f18515e64d9ec6053a078b5d6d74941c6417849f41507b87f800f34e276aab4a998d36ea

    • SSDEEP

      1536:TtZI/EFAt9W3bmSuhLRS6r5JZM000000xoXwakywkdQO6nKQrUoR24HsUs:YcFAtVxlS4ZM000000xxaRwk2U6THsR

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.