Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

28d5add493...0N.exe

windows7-x64

10

28d5add493...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28d5add493f53261016074a1129841d15326d22275cc119c13174d053b0c6f90N.exe

  • Size

    74KB

  • Sample

    241225-yasnmatrfv

  • MD5

    75ed1e0a64f6b3d12f55a25edc4d5040

  • SHA1

    4f54e7cb8ccb272d405b5569f11b51b954711490

  • SHA256

    28d5add493f53261016074a1129841d15326d22275cc119c13174d053b0c6f90

  • SHA512

    a108548e354f807d1bdbc2a3ff08c5719c6f3f53de988b3d2780ced88da48ab5a2c95c7865ce71c72348ed00268d3dd181e46bbbed6e267e3678a143c28a4e60

  • SSDEEP

    1536:0Z78MIBe868UZYPVPW4F7YN4NAbLjaATntdr8IXm9cj:+zwe8689H5YN4NwL5TnXYIXScj

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      28d5add493f53261016074a1129841d15326d22275cc119c13174d053b0c6f90N.exe

    • Size

      74KB

    • MD5

      75ed1e0a64f6b3d12f55a25edc4d5040

    • SHA1

      4f54e7cb8ccb272d405b5569f11b51b954711490

    • SHA256

      28d5add493f53261016074a1129841d15326d22275cc119c13174d053b0c6f90

    • SHA512

      a108548e354f807d1bdbc2a3ff08c5719c6f3f53de988b3d2780ced88da48ab5a2c95c7865ce71c72348ed00268d3dd181e46bbbed6e267e3678a143c28a4e60

    • SSDEEP

      1536:0Z78MIBe868UZYPVPW4F7YN4NAbLjaATntdr8IXm9cj:+zwe8689H5YN4NwL5TnXYIXScj

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks