Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bdfe6e1548...7b.exe

windows7-x64

10

bdfe6e1548...7b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdfe6e154842ef6bce1bdf96b06ea347d1706d2a58afc37083cc543d0a1ff47b

  • Size

    63KB

  • Sample

    241225-cr79ravkhl

  • MD5

    ef3ab64106eeafb5805d2c8f2d86b873

  • SHA1

    fb876126d396622ccc591c5937b9f95fccb22fce

  • SHA256

    bdfe6e154842ef6bce1bdf96b06ea347d1706d2a58afc37083cc543d0a1ff47b

  • SHA512

    327c356eb6fd9cb11fe8aead5e19d4f6a357584da713204e4ce38a0584d1f69c9273373238b9d7c687f95ce872b8d05ca0457e6e69d7f22f3838d2d53a714631

  • SSDEEP

    1536:hJLEVOhr1YaX8qjfH+Y4zrbQ7DAwsTfHK1H1juIZo:hlEVwr1R8zPpwo/6H1juIZo

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      bdfe6e154842ef6bce1bdf96b06ea347d1706d2a58afc37083cc543d0a1ff47b

    • Size

      63KB

    • MD5

      ef3ab64106eeafb5805d2c8f2d86b873

    • SHA1

      fb876126d396622ccc591c5937b9f95fccb22fce

    • SHA256

      bdfe6e154842ef6bce1bdf96b06ea347d1706d2a58afc37083cc543d0a1ff47b

    • SHA512

      327c356eb6fd9cb11fe8aead5e19d4f6a357584da713204e4ce38a0584d1f69c9273373238b9d7c687f95ce872b8d05ca0457e6e69d7f22f3838d2d53a714631

    • SSDEEP

      1536:hJLEVOhr1YaX8qjfH+Y4zrbQ7DAwsTfHK1H1juIZo:hlEVwr1R8zPpwo/6H1juIZo

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.