Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

bdb48f8273...8a.exe

windows7-x64

10

bdb48f8273...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdb48f827370c257ef075216352bacee9395348df156ed0ba0091386231bc28a.exe

  • Size

    443KB

  • Sample

    250217-caxfxswlfw

  • MD5

    bb8ffc62d2beaf61fbe9db4265991b16

  • SHA1

    b49ab962dd2fe69485fd35c3b79ae2981ef0c34c

  • SHA256

    bdb48f827370c257ef075216352bacee9395348df156ed0ba0091386231bc28a

  • SHA512

    9ef3853ccf03ebca63b257894343e3793987725fefeb0dac43a136e81ca9e908675db8477ec6bdadd2dd00569bbb6fd2cdb2e0143de9873f77b65f80845c7d57

  • SSDEEP

    6144:JNOh+kvi7zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOE8:JN9ku1J1HJ1Uj+HiPjG

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      bdb48f827370c257ef075216352bacee9395348df156ed0ba0091386231bc28a.exe

    • Size

      443KB

    • MD5

      bb8ffc62d2beaf61fbe9db4265991b16

    • SHA1

      b49ab962dd2fe69485fd35c3b79ae2981ef0c34c

    • SHA256

      bdb48f827370c257ef075216352bacee9395348df156ed0ba0091386231bc28a

    • SHA512

      9ef3853ccf03ebca63b257894343e3793987725fefeb0dac43a136e81ca9e908675db8477ec6bdadd2dd00569bbb6fd2cdb2e0143de9873f77b65f80845c7d57

    • SSDEEP

      6144:JNOh+kvi7zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOE8:JN9ku1J1HJ1Uj+HiPjG

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks