not_berm | 230220-lkjggsdhga_pw_infected[.]zip

General

Target
230220-lkjggsdhga_pw_infected.zip
Size 252KB
Sample230413-lctbqaae53
SHA256 b74246cfa35210311980e9a10c860ee14498a41a052cba66774cbbb6028cc178
MD5 7939039aa0597355315ce7e469c059e6
SHA1 1160e51ab21c3dcd245f9e9d5db0ff15dc2b5475
SHA512 8e724bffa33b86c2af3cdba1d87c4e73c928a2d7f724abfd1b4803cde08cca05ba6e1b06077586b895d33a1524c8159b10cd3f158fa23f6a8785a997dde686d0
SSDEEP 6144:ll/56QteZ9qCLYtj5TIPiR+4tSp8+y5O6zn9xoN7B:HR6HX1q44tSq5O6zn0VB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

taggie_berm_you_are_it not_berm

Malware Config

Signatures

Not_berm family
not_berm

match_everything 2 IoCs

This rule matches all.

taggie_berm_you_are_it

resource	yara_rule
sample	match_everything
static1/unpack002/f61d82e58afeff34e7055ecc5bfead5325646100a6d7d6f4db40cc530c2cf3e9	match_everything

File Explorer

230220-lkjggsdhga_pw_infected.zip

.zip 252KB
230216-ppgp8sfngl_pw_infected.zip

.zip 251KB
f61d82e58afeff34e7055ecc5bfead5325646100a6d7d6f4db40cc530c2cf3e9

.exe 305KB

230220-lkjggsdhga_pw_infected.zip

SHA256 b74246cfa35210311980e9a10c860ee14498a41a052cba66774cbbb6028cc178
MD5 7939039aa0597355315ce7e469c059e6
SHA1 1160e51ab21c3dcd245f9e9d5db0ff15dc2b5475
SHA512 8e724bffa33b86c2af3cdba1d87c4e73c928a2d7f724abfd1b4803cde08cca05ba6e1b06077586b895d33a1524c8159b10cd3f158fa23f6a8785a997dde686d0
SSDEEP 6144:ll/56QteZ9qCLYtj5TIPiR+4tSp8+y5O6zn9xoN7B:HR6HX1q44tSq5O6zn0VB
MD5 SHA1 SHA512 SSDEEP

match_everything

This rule matches all.

taggie_berm_you_are_it

Password

infected

f61d82e58afeff34e7055ecc5bfead5325646100a6d7d6f4db40cc530c2cf3e9

IMPHASH 748b0eafa4398761b8a8492be85d4b26
SHA256 f61d82e58afeff34e7055ecc5bfead5325646100a6d7d6f4db40cc530c2cf3e9
MD5 0bfe96561c609b5e6fac0a108e9ca8f8
SHA1 26d0dc626d4d229eb2f7c72603bb545182d6d562
SHA512 8d6d0a0f51d4809de0af371862944dd4f9782ec26e8343214b0d96db2aecccc09c97838514ede659bf075fd5f06333b21da5f2e08a272391badfab65f493c090
SSDEEP 6144:g2BT7E7RK/NYl0TZdLMG5sgfbdW8BeqdFq7LPEK9/g5UL6LuzxAPr:g2BT7Fuled4G5MM+LPEDqLAuzxAD
MD5 SHA1 SHA512 SSDEEP

windows x86

match_everything

This rule matches all.

taggie_berm_you_are_it

Minor OS version

Major OS version

Entry point

15515

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyW lstrcpyA lstrlenW GetProcAddress LoadLibraryA VirtualAlloc HeapAlloc WideCharToMultiByte lstrlenA GetModuleFileNameW CreateFileW GetFileSize ReadFile CloseHandle GetModuleHandleW GetConsoleWindow WriteConsoleW HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess EncodePointer RaiseException GetLastError SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx DecodePointer

user32

ShowWindow

shell32

CommandLineToArgvW

Name

.text

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

htr34d*

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

230220-lkjggsdhga_pw_infected.zip

230216-ppgp8sfngl_pw_infected.zip

f61d82e58afeff34e7055ecc5bfead5325646100a6d7d6f4db40cc530c2cf3e9

kernel32

user32

shell32