Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bdc554bcbb...37.exe

windows7-x64

10

bdc554bcbb...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdc554bcbb1094b58f9acad93c9e3f39804c55a8c8a4e444b203c497068b3a37

  • Size

    384KB

  • Sample

    250305-kl49xatycy

  • MD5

    977fa1a42570f642c27db76dc3dda655

  • SHA1

    da5fbbd15ffeeafd25095f3392ec708de10e9c5a

  • SHA256

    bdc554bcbb1094b58f9acad93c9e3f39804c55a8c8a4e444b203c497068b3a37

  • SHA512

    57c085a34caa778cdcbb664405bc6a79a8c274b2c7d4485c5132477774103269024b41374e5c159157d459406da59d94387c2be9e3227092fa46fb9dfb45c0a8

  • SSDEEP

    12288:3ph6WCwR1gGyXu1jGG1wsGeBgRTGAzciETdqvZNemWrsiLk6x:v6WCwR1gGyXsGG1wsLUT3Iia

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bdc554bcbb1094b58f9acad93c9e3f39804c55a8c8a4e444b203c497068b3a37

    • Size

      384KB

    • MD5

      977fa1a42570f642c27db76dc3dda655

    • SHA1

      da5fbbd15ffeeafd25095f3392ec708de10e9c5a

    • SHA256

      bdc554bcbb1094b58f9acad93c9e3f39804c55a8c8a4e444b203c497068b3a37

    • SHA512

      57c085a34caa778cdcbb664405bc6a79a8c274b2c7d4485c5132477774103269024b41374e5c159157d459406da59d94387c2be9e3227092fa46fb9dfb45c0a8

    • SSDEEP

      12288:3ph6WCwR1gGyXu1jGG1wsGeBgRTGAzciETdqvZNemWrsiLk6x:v6WCwR1gGyXsGG1wsLUT3Iia

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks