Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

9cfa7d7be3...13.exe

windows7-x64

10

9cfa7d7be3...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cfa7d7be3a245a50f96229b62b9bfb410e6e81f93ec9f2488e460d63391c213

  • Size

    378KB

  • Sample

    250308-gn1sqasn12

  • MD5

    3e29cea0103630f257078df553087f34

  • SHA1

    9cba4964aaaea54046d454622531f25fae29ed31

  • SHA256

    9cfa7d7be3a245a50f96229b62b9bfb410e6e81f93ec9f2488e460d63391c213

  • SHA512

    44ed782b6011f97f2d3f77965be61b348eb7ace80b1a2b407d0f33b235910a58e19c19d347eb987eb0b65d13a74b7344949022d8e476bafc3d345fdb16fd0477

  • SSDEEP

    6144:mCk+wlubO8E8eYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GT9:mC+uyh8eYr75lTefkY660fIaDZkY6605

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9cfa7d7be3a245a50f96229b62b9bfb410e6e81f93ec9f2488e460d63391c213

    • Size

      378KB

    • MD5

      3e29cea0103630f257078df553087f34

    • SHA1

      9cba4964aaaea54046d454622531f25fae29ed31

    • SHA256

      9cfa7d7be3a245a50f96229b62b9bfb410e6e81f93ec9f2488e460d63391c213

    • SHA512

      44ed782b6011f97f2d3f77965be61b348eb7ace80b1a2b407d0f33b235910a58e19c19d347eb987eb0b65d13a74b7344949022d8e476bafc3d345fdb16fd0477

    • SSDEEP

      6144:mCk+wlubO8E8eYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GT9:mC+uyh8eYr75lTefkY660fIaDZkY6605

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks