not_berm | 230220-rpstlsfjcp_pw_infected[.]zip

General

Target
230220-rpstlsfjcp_pw_infected.zip
Size 867KB
Sample230322-pv1ejagg77
SHA256 356e56ae32b43f0f755e99e6b7042ca1bafab49f40cbfe92c10db52f21a8e08a
MD5 fb139ace674a88842f786f30f6639c43
SHA1 d70d6e80d05cfe183075f466902d74fc0b0f31aa
SHA512 7dcecae646c6e96790f4aee829ee698dc9cb5a8343381836ab8e0a3739e4ac0964a5650c9921bdcb8ec42964d5bbdace32a86e5c13a541dbbe5e999a2c8123d3
SSDEEP 24576:Qsq9HhhyEJ1rcu/5wPhT/iN+iWoTMTlSv/GsH6iBSWXS:Q1hhyKFcxQMQYTsv9RSWXS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

taggie_berm_you_are_it not_berm berm

Malware Config

Signatures

Berm family
berm
Not_berm family
not_berm

match_everything 2 IoCs

This rule matches all.

taggie_berm_you_are_it

resource	yara_rule
sample	match_everything
static1/unpack001/stubbie.exe	match_everything

put description here 1 IoCs

Berms super malware.

taggie_berm_you_are_it

resource	yara_rule
static1/unpack001/stubbie.exe	berm

File Explorer

230220-rpstlsfjcp_pw_infected.zip

.zip 867KB
stubbie.exe

.exe 1.9MB

230220-rpstlsfjcp_pw_infected.zip

SHA256 356e56ae32b43f0f755e99e6b7042ca1bafab49f40cbfe92c10db52f21a8e08a
MD5 fb139ace674a88842f786f30f6639c43
SHA1 d70d6e80d05cfe183075f466902d74fc0b0f31aa
SHA512 7dcecae646c6e96790f4aee829ee698dc9cb5a8343381836ab8e0a3739e4ac0964a5650c9921bdcb8ec42964d5bbdace32a86e5c13a541dbbe5e999a2c8123d3
SSDEEP 24576:Qsq9HhhyEJ1rcu/5wPhT/iN+iWoTMTlSv/GsH6iBSWXS:Q1hhyKFcxQMQYTsv9RSWXS
MD5 SHA1 SHA512 SSDEEP

match_everything

This rule matches all.

taggie_berm_you_are_it

Password

infected

stubbie.exe

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 b362b3427c735bc17b0331a6eb3423075defbc2267413e02fd0d8b50639130c0
MD5 d76160184cd34eaead682a998af16d97
SHA1 34bde9eb28193cfe170c8f0b8730d90b66abae3e
SHA512 1b57037a49476a9313a6349fa3790b7557b38085b1aeae2105ae108c696c9b01139ec68f99e543b5a7c33556eea8d8e3f24e8ffed28a2bd5b23d449f149b3b34
SSDEEP 49152:Tsf8+G3sJ1rb/TQvO90d7HjmAFd4A64nsfJTpfggUCjwf3I2D1:T3r
MD5 SHA1 SHA512 SSDEEP

windows x64

match_everything

This rule matches all.

taggie_berm_you_are_it
put description here

Berms super malware.

taggie_berm_you_are_it

Minor OS version

Major OS version

Entry point

411232

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

900KB

Virtual Size

899KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

929KB

Virtual Size

928KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

465KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

230220-rpstlsfjcp_pw_infected.zip

stubbie.exe

kernel32