Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

19840d0db7...fN.exe

windows7-x64

10

19840d0db7...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19840d0db7c33106f2976e8ecaa0cb58d1946821062bf95171e732bc387b555fN.exe

  • Size

    92KB

  • Sample

    241225-y4b8qswpfp

  • MD5

    f586028c2e3e51c442f12cc7dc1442b0

  • SHA1

    7ec8e30b59c8338d725b7cfd8bda848b4ed2246b

  • SHA256

    19840d0db7c33106f2976e8ecaa0cb58d1946821062bf95171e732bc387b555f

  • SHA512

    4c28c05c35fb1cf48e00f80450f76e6214b3470deecc355ea89da2a7a59c9b578d932d8fce64561ee4b6c64f894a087b5a5bf9bbf0b0f5e53c586011206ec589

  • SSDEEP

    1536:FB93026V8MgvZpmA3LoqECpj5bL2LDIhCcCLDvVvsNVnvosg74z2D6mp:Fz3nZvtKCpFboDsC1LJsjvosg74w6mp

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      19840d0db7c33106f2976e8ecaa0cb58d1946821062bf95171e732bc387b555fN.exe

    • Size

      92KB

    • MD5

      f586028c2e3e51c442f12cc7dc1442b0

    • SHA1

      7ec8e30b59c8338d725b7cfd8bda848b4ed2246b

    • SHA256

      19840d0db7c33106f2976e8ecaa0cb58d1946821062bf95171e732bc387b555f

    • SHA512

      4c28c05c35fb1cf48e00f80450f76e6214b3470deecc355ea89da2a7a59c9b578d932d8fce64561ee4b6c64f894a087b5a5bf9bbf0b0f5e53c586011206ec589

    • SSDEEP

      1536:FB93026V8MgvZpmA3LoqECpj5bL2LDIhCcCLDvVvsNVnvosg74z2D6mp:Fz3nZvtKCpFboDsC1LJsjvosg74w6mp

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.