Behavioral task
behavioral1
Sample
NEAS.dd2a1d82159b868edfceb90dcabac170.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.dd2a1d82159b868edfceb90dcabac170.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.dd2a1d82159b868edfceb90dcabac170.exe
-
Size
431KB
-
MD5
dd2a1d82159b868edfceb90dcabac170
-
SHA1
c406a52a11ad1a83fda96c8f625935ddd0b1a68f
-
SHA256
92658f1c22c22bd7db404613bab8529b8fae3b19ff76e1eeaa5a2e5301b82ac2
-
SHA512
6841fb5fce15e14d3cf8f0fac6e43927c47a48f8e96c5bf6abee9997d9dcfc83c01b01c7a4e53848b6e230c73728f2a374e874f2b82f65da56cfd71ba6451b57
-
SSDEEP
3072:M1gEZl0nt/P1YPx/on3KXh4TbptVTbCofXJ6ym2wRdQJ4mTZQj2+mQ:cZl89WxtXh4TdDKofXjmVoe2+R
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.dd2a1d82159b868edfceb90dcabac170.exe
Files
-
NEAS.dd2a1d82159b868edfceb90dcabac170.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ