Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    eb615da565aec62cb7aee61af7fa043097544831bfeedb24ed674aadbce5b018N.exe

  • Size

    64KB

  • Sample

    241225-tjhgssxraj

  • MD5

    fa588e09fa058674dd2dbb468739e120

  • SHA1

    285fa899126cb6c277413e16cadbcdb9a2eb33bc

  • SHA256

    eb615da565aec62cb7aee61af7fa043097544831bfeedb24ed674aadbce5b018

  • SHA512

    63cbd646d97dab4a5267b587b829b6d41d6a9a9162d451d23697159229f5fc4eb7cc59b2454ff981569ed728b97013ee9c3e593720e3484b766989db506f3b01

  • SSDEEP

    768:KHJm3Nr2/ewccYlxO1EmhmWBuUkA9C64Lxb1//1H5t6XJ1IwEGp9ThfzyYsHd:K0d29jP1v4VTzRWXUwXfzwd

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      eb615da565aec62cb7aee61af7fa043097544831bfeedb24ed674aadbce5b018N.exe

    • Size

      64KB

    • MD5

      fa588e09fa058674dd2dbb468739e120

    • SHA1

      285fa899126cb6c277413e16cadbcdb9a2eb33bc

    • SHA256

      eb615da565aec62cb7aee61af7fa043097544831bfeedb24ed674aadbce5b018

    • SHA512

      63cbd646d97dab4a5267b587b829b6d41d6a9a9162d451d23697159229f5fc4eb7cc59b2454ff981569ed728b97013ee9c3e593720e3484b766989db506f3b01

    • SSDEEP

      768:KHJm3Nr2/ewccYlxO1EmhmWBuUkA9C64Lxb1//1H5t6XJ1IwEGp9ThfzyYsHd:K0d29jP1v4VTzRWXUwXfzwd

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks