Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

c0d43a53b3...58.exe

windows7-x64

10

c0d43a53b3...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0d43a53b3efa6e0b005f3288ee1afba385c421bf5ef1e638e89a7618307b758

  • Size

    144KB

  • Sample

    250305-ktb84avkx8

  • MD5

    1575940487bfe500ef7e284afc015ca4

  • SHA1

    b03875a113b05df01071a3ed0bb5ac2735b17106

  • SHA256

    c0d43a53b3efa6e0b005f3288ee1afba385c421bf5ef1e638e89a7618307b758

  • SHA512

    1f4ff2720ad9fa9aba8a2785070b58762375bda0537fda4196ed5d8321a06671bc0f0cd49768198d8bca937ad470825a3aef4a3bea4bc4c94c5afdfd8b9bd978

  • SSDEEP

    3072:nsP1pUOgJXvfwizWX7g5Vcgb3a3+X13XRzrgHq/Wp+YmKfxgQL:sPrUxVq6VZ7aOl3BzrUmKy0

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c0d43a53b3efa6e0b005f3288ee1afba385c421bf5ef1e638e89a7618307b758

    • Size

      144KB

    • MD5

      1575940487bfe500ef7e284afc015ca4

    • SHA1

      b03875a113b05df01071a3ed0bb5ac2735b17106

    • SHA256

      c0d43a53b3efa6e0b005f3288ee1afba385c421bf5ef1e638e89a7618307b758

    • SHA512

      1f4ff2720ad9fa9aba8a2785070b58762375bda0537fda4196ed5d8321a06671bc0f0cd49768198d8bca937ad470825a3aef4a3bea4bc4c94c5afdfd8b9bd978

    • SSDEEP

      3072:nsP1pUOgJXvfwizWX7g5Vcgb3a3+X13XRzrgHq/Wp+YmKfxgQL:sPrUxVq6VZ7aOl3BzrUmKy0

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks