Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bd23b065f5...9c.exe

windows7-x64

10

bd23b065f5...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd23b065f5c6e2b72f3bd0f223da9a9da31be741ccb8cff22a00833424af499c

  • Size

    232KB

  • Sample

    250305-kj4klatrx5

  • MD5

    1f14660374851866d52a28694758e7e4

  • SHA1

    6f1a765ee397b6b70c060d5ff8de7294787e3be2

  • SHA256

    bd23b065f5c6e2b72f3bd0f223da9a9da31be741ccb8cff22a00833424af499c

  • SHA512

    818e29d3a901d854d20911fd3df5152e1d8534fad1115fc8997e73827065bb4775ba30e3d445e0dd2243ed5446cff3a86c3362e2c27a9afe9f539d12ddfa51c2

  • SSDEEP

    3072:/p6rl5yWWQ7usluTXp6UF5wzec+tZOnU1/s5HH0AU/yRvS3u121TzlbNRfzPadOF:/kmQ6s21L7/s50z/Wa3/PNlPX

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      bd23b065f5c6e2b72f3bd0f223da9a9da31be741ccb8cff22a00833424af499c

    • Size

      232KB

    • MD5

      1f14660374851866d52a28694758e7e4

    • SHA1

      6f1a765ee397b6b70c060d5ff8de7294787e3be2

    • SHA256

      bd23b065f5c6e2b72f3bd0f223da9a9da31be741ccb8cff22a00833424af499c

    • SHA512

      818e29d3a901d854d20911fd3df5152e1d8534fad1115fc8997e73827065bb4775ba30e3d445e0dd2243ed5446cff3a86c3362e2c27a9afe9f539d12ddfa51c2

    • SSDEEP

      3072:/p6rl5yWWQ7usluTXp6UF5wzec+tZOnU1/s5HH0AU/yRvS3u121TzlbNRfzPadOF:/kmQ6s21L7/s50z/Wa3/PNlPX

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks