Behavioral task
behavioral1
Sample
NEAS.c634c4571bf22855d8b4fdeda8ad3340.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.c634c4571bf22855d8b4fdeda8ad3340.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c634c4571bf22855d8b4fdeda8ad3340.exe
-
Size
289KB
-
MD5
c634c4571bf22855d8b4fdeda8ad3340
-
SHA1
639e4a9cb04be5eb1227ab0777167fbaccc20851
-
SHA256
9b866aa56d642a5a576499e38a40cc9aff9034978b33c2e1b54f53aea48f20fe
-
SHA512
4d71d140fc812b6c3085ebe4b62f8367ee7cba5a18a2fdc916fd47b91453430c0528bf09c3b340440bf37796c8432c32af87617ecc09c5ee449ed6c2aaa1d0c8
-
SSDEEP
6144:lMvYLpsMlX+lK7faZ8BNDqIokECzJLaQVbU5:EipsMNeZ8BBhoklJLJbU5
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c634c4571bf22855d8b4fdeda8ad3340.exe
Files
-
NEAS.c634c4571bf22855d8b4fdeda8ad3340.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ