Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    76640a77db9c1ed5f1ff9e5e477d4042620f8ae1eb7422eb0622e9a825e540ee

  • Size

    96KB

  • Sample

    250217-cbcg5swlgv

  • MD5

    fdc4afbc5a772f9be71eefedb5b9a7d5

  • SHA1

    6f25d84af9689748dfe247a70cdd10a8c0213563

  • SHA256

    76640a77db9c1ed5f1ff9e5e477d4042620f8ae1eb7422eb0622e9a825e540ee

  • SHA512

    685741d8563b9f9233cafcaedbcaf2fe8925934ed58b6d1675fccdb062181f37b352ca7fcc7ec60ada220950afee4aad43607255ab0fb3ef5c4b10eb960f4383

  • SSDEEP

    1536:fMJ+WHtSc/h2Vh5hPUabjc/igJnxYZpa5VNAeLZ3P4P2K8TD2QUNOhF9duV9jojs:EM68c/iDUPHJnxYjqVjLB7fTD2QUNOhS

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      76640a77db9c1ed5f1ff9e5e477d4042620f8ae1eb7422eb0622e9a825e540ee

    • Size

      96KB

    • MD5

      fdc4afbc5a772f9be71eefedb5b9a7d5

    • SHA1

      6f25d84af9689748dfe247a70cdd10a8c0213563

    • SHA256

      76640a77db9c1ed5f1ff9e5e477d4042620f8ae1eb7422eb0622e9a825e540ee

    • SHA512

      685741d8563b9f9233cafcaedbcaf2fe8925934ed58b6d1675fccdb062181f37b352ca7fcc7ec60ada220950afee4aad43607255ab0fb3ef5c4b10eb960f4383

    • SSDEEP

      1536:fMJ+WHtSc/h2Vh5hPUabjc/igJnxYZpa5VNAeLZ3P4P2K8TD2QUNOhF9duV9jojs:EM68c/iDUPHJnxYjqVjLB7fTD2QUNOhS

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks