Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cf28677c2e...2e.exe

windows7-x64

10

cf28677c2e...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf28677c2e379e7e6ed570ba75b3267a99fc2154fbdb1c19aed2e21f15e6a32e

  • Size

    64KB

  • Sample

    241225-de3n6svrgt

  • MD5

    c7d1396abfa4620531924b9db8908331

  • SHA1

    be33402cda38f019c1a332d107b5f90cf4d13c8c

  • SHA256

    cf28677c2e379e7e6ed570ba75b3267a99fc2154fbdb1c19aed2e21f15e6a32e

  • SHA512

    9eabfef26c2edca5c3621cb45b05096ccdde8ca7a4f977fad9f75c11267ef10d78c61c94aa6d48812dac906afaa61ced16c99e7dca3cad6b4e8ddd6a1abf3909

  • SSDEEP

    768:P02eoss0yAf4GYLs3QzcDirZIvRmuxGRwaa1+6lQExFifQ52p/1H5qeXdnh0UsbK:FssWf4GYLs6RrZdUG9ak6FwG2LDrDWB2

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      cf28677c2e379e7e6ed570ba75b3267a99fc2154fbdb1c19aed2e21f15e6a32e

    • Size

      64KB

    • MD5

      c7d1396abfa4620531924b9db8908331

    • SHA1

      be33402cda38f019c1a332d107b5f90cf4d13c8c

    • SHA256

      cf28677c2e379e7e6ed570ba75b3267a99fc2154fbdb1c19aed2e21f15e6a32e

    • SHA512

      9eabfef26c2edca5c3621cb45b05096ccdde8ca7a4f977fad9f75c11267ef10d78c61c94aa6d48812dac906afaa61ced16c99e7dca3cad6b4e8ddd6a1abf3909

    • SSDEEP

      768:P02eoss0yAf4GYLs3QzcDirZIvRmuxGRwaa1+6lQExFifQ52p/1H5qeXdnh0UsbK:FssWf4GYLs6RrZdUG9ak6FwG2LDrDWB2

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.