Behavioral task
behavioral1
Sample
NEAS.eef60ee1a93c5af10c227eb1e9a72c30_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.eef60ee1a93c5af10c227eb1e9a72c30_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.eef60ee1a93c5af10c227eb1e9a72c30_JC.exe
-
Size
262KB
-
MD5
eef60ee1a93c5af10c227eb1e9a72c30
-
SHA1
733d54230a133e7591568b52221d5ab8cade77c7
-
SHA256
2475803ce7343c6188ecdb96ebbc48f9c0c2056a068960d5b887970d242452cf
-
SHA512
484bab45b54cb4acc666c0705e5f80a3336a9730e3c21a8bd2618442ce472f630fdc55d28801b90706734bd24a426d4078545e303b88975ee6073f738de42e97
-
SSDEEP
6144:SyiMJ6f8jLi2CMw5w31Lx4tiqn/PlVGSu4RiNdpxPtOS:SyiMYs8UFLxYNQWRap/d
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.eef60ee1a93c5af10c227eb1e9a72c30_JC.exe
Files
-
NEAS.eef60ee1a93c5af10c227eb1e9a72c30_JC.exe.exe windows:4 windows x86
16413337807aa90209802135c46c1b4d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
winmm
waveOutReset
midiInMessage
GetDriverModuleHandle
joyGetDevCapsW
mmioRead
waveOutGetErrorTextW
mmioOpenA
mmioWrite
mmioSetBuffer
waveInGetErrorTextA
DrvGetModuleHandle
timeGetTime
midiOutSetVolume
joySetThreshold
Sections
.text Size: 240KB - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ