Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3a054265260793234d6652dccb3a6dd4c6b09cf407b2b480a275f66031022232

  • Size

    89KB

  • Sample

    241225-xz16matqdk

  • MD5

    dfd785dd8687bf80ec19876fb56f7091

  • SHA1

    89563a1a3d1ff6bb66ee009732833222da149a3b

  • SHA256

    3a054265260793234d6652dccb3a6dd4c6b09cf407b2b480a275f66031022232

  • SHA512

    8771aaf5a15220befad0d2886ddcf515f69c143b4c920b61c8c07283f0ae4ff0c4b22c94d550e823f291dfcb1060b0887d00b29f9c34f76b5f616b5ac243c8fa

  • SSDEEP

    1536:G8NDMEBnlhDkvES4d2Y2PuSi23MWzFRQPD68a+VMKKTRVGFtUhQfR1WRaROR8R:GuMVvE5dTSi2/xemr4MKy3G7UEqMM6

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      3a054265260793234d6652dccb3a6dd4c6b09cf407b2b480a275f66031022232

    • Size

      89KB

    • MD5

      dfd785dd8687bf80ec19876fb56f7091

    • SHA1

      89563a1a3d1ff6bb66ee009732833222da149a3b

    • SHA256

      3a054265260793234d6652dccb3a6dd4c6b09cf407b2b480a275f66031022232

    • SHA512

      8771aaf5a15220befad0d2886ddcf515f69c143b4c920b61c8c07283f0ae4ff0c4b22c94d550e823f291dfcb1060b0887d00b29f9c34f76b5f616b5ac243c8fa

    • SSDEEP

      1536:G8NDMEBnlhDkvES4d2Y2PuSi23MWzFRQPD68a+VMKKTRVGFtUhQfR1WRaROR8R:GuMVvE5dTSi2/xemr4MKy3G7UEqMM6

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks