Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

971828d853...50.exe

windows7-x64

10

971828d853...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    971828d853381b79ab9396d6b1b59c34ebd02555a9a3515b28649a289179fe50

  • Size

    73KB

  • Sample

    250308-ex8tks1ybz

  • MD5

    938b9b91dc9b68566c30df38e473857a

  • SHA1

    4f835a6b54945f1d6cdaea9c2950e9b87ce05914

  • SHA256

    971828d853381b79ab9396d6b1b59c34ebd02555a9a3515b28649a289179fe50

  • SHA512

    f32be2dbc4595388e1af311f9c39d602a76c90f45d35de5c0efa057612d8b66e8bd7d77d5b31943498407c5ff50c4d9789d44fd012b631268d2cd2cfc731949a

  • SSDEEP

    1536:uXwftVYkwxw6vestycsi4SWAC//TG4NIwcQ1MIF9:uXwftBwi6ve2sik//TvnR1ME9

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      971828d853381b79ab9396d6b1b59c34ebd02555a9a3515b28649a289179fe50

    • Size

      73KB

    • MD5

      938b9b91dc9b68566c30df38e473857a

    • SHA1

      4f835a6b54945f1d6cdaea9c2950e9b87ce05914

    • SHA256

      971828d853381b79ab9396d6b1b59c34ebd02555a9a3515b28649a289179fe50

    • SHA512

      f32be2dbc4595388e1af311f9c39d602a76c90f45d35de5c0efa057612d8b66e8bd7d77d5b31943498407c5ff50c4d9789d44fd012b631268d2cd2cfc731949a

    • SSDEEP

      1536:uXwftVYkwxw6vestycsi4SWAC//TG4NIwcQ1MIF9:uXwftBwi6ve2sik//TvnR1ME9

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks