�9dx�5D��d�+4#h�y�����q:�g�����._��Q{�qw"a ������Y� ?�u�j]�z\���iYO���sΊAI������ѣ�..<���>�t�2���7��d������j�s ��;��L���������vm3�|V*;��)�\d&�5�`��]Vc'd��~�����q��+<���*��ѐ�u�t��i�1Ξ��86����,�ɠQR�(��+ /�O����B�ڌ��F]8�3�dpN��]�6��g*\f6���RWC��H�MX�S�h��TP��U�| �!;�39������6̫�8�{E��i��̱Sq�Uw��7Ϧ�X�Ww/��qfkb�15�̬aE:�_%�m�V�7���A��$���8̟�?4���l496�*y��B����)�~l�@���;��]�Vc�V�z]X���v�i�/}�c����AR�_��p�JB�������i�cYO�u���F��{l��ǿ���3$v͎�@e�<"I-N#i�.� 5���.QX��2EF�yPR�I`��=�6�:�������_)q>p;���G�)h���s�+��|Rt�����QOm.oAEB�>_E�!��3v�&ݖ�2��:mPL���� �>���,b.�_h|��$�.^�,9Nc^�)�7aX��+*���/B���@?�jzK6!��K�46��#�� ��XiO�[>4"Q�q���c%��&�ۛ0�}#�n@(�+�����y���7.([x*�7w�(�����o:�:I�/߸������`"* ��(o����CV� #�lE&�E+�d)xH�D� ���W��}iᶆ�q�S��'r�J �4� ��g���C&�k�j�JP6�:�g��q���4���@1'�L����]�LdИB�܍5R�m?�i\�q�v��:�>�c����U[�!1܊��ޛt]�;�ǂ�W<�·R�_+)!�ի_�4��{�:d�v��#9����i���Q�_Б�M� /ى��to؟,���F� ������MA1X�0k;HO�Y����`@r�rt�_v�]�8���.��<�N� �ūh ���C2�3v�7�V�U�8U�����V ����$Նhew ш���XBCf�s���j�68Pe��l���z(5����o�%zǒ��l?��*U�5Ť'����=�a��>I���*�a�?�7�&�_..�+�"����{��J�%>�������f0I�^�0���m6������g�F���݊7�nj^2٧���7�R$��a�G�F�室���3<��@��T��VF!������>ɋ���=�/F5$��OB��km+{����N2W�98����xӬ����\`U٘+oMb ,E���#��� �W�5��o@D�ZT��z�R�E~�I,���kA���<O��ͥN�5G=B[e�s�:S?�nL@g�d,�.�V�������y�P�>}=���\=խG ��"� �4#�Y'9� J���l7�����df�7���/��q YX0CB۪� N���)�5� "�k�ZX��c8��Oy�f��}n�wh�G��m�#�aլPa�R�I��� :�}���z��E���x�QfuoY��e�������J)�y�ic�Â�X�8(0�Ї&�#���f��c]'�R�H���:���]Ph�Ԓ}������bOl�t����**�6��@Z��>e����6�h���ѫ�~�����[�����:ԗ��̋Z~2� ���=�]a��uky�5JN�34�9��c��56�B�-��;[�r�r:����*��A<}��|��aK�eC�K~��-�����0P�b�$K�#V /�xר�;�����$'�`�G�T�AL,)j>��票�� &�]�z��8��P�nq�:k�f)�A�^�[PX����_����*C���HT)�#���u{�6 s�+ߩ)��/#��P[0����@���oq�f:�|��`�i��q�yNj�AR�l�ڴ<r�����S�ި{��W+E[����1���[��[U__�3��z�X�,@\���.�n�8���_���`s �_a�;są�ѨB/�?�O &��~�#k)4�Zp����(Tcs8���i��h���aI ⵘ���U�}��]YATv�z4LQ��9 �l��^>�tQ��e>r=��3'��������m�|�'�\s�.PtQ���+�5��5�^��=�^+��a-�읉��A��eS8�0R����DYP{3�}cZ��O�������� '��h�t��b�=Q�d3!k�v�2��l$�0�h/����������I��*jIkl��)u�z�ek]�T>k�A��{�(��q�E�Y֢C�k��8�U? h�}7�t����q���J4v�O�q�������th4�\USa�����A��O�l%�̥p" �����*�W�c�FKP�l�%W���nU#��Z��u��?�j����6���u���0�k��&%�l���A�L���g}Yr����,p<�o���G�kyp$:���EdԮ��m*{w�M��ą�����0wy`����߮�`�s4��P,FseW����~:�)k��Rjw�a��J���ۮ3w�,��*�_������D�vđ�E�M&�[�M�w}�0��f!$-��^�-�j��LCއ��PԍvV���M+� �~=�},D�|���ci��H�����m�!# �MJPB�՞��+}D���3��.�R�)r �R�E� �8'�d���F���'���A�}��x6o��j��-V?�s��8��Y#6y�ϩ�&~��l�|B~��M�Ofb��k���6S��Ǖ��y#>�gp'&��^掠���i���,��|��DS�$�\\�p���L����k��J4SDrZLdm�bv\� #�V�:1 N�yRW�Dk��'�ߛBXC�c7���d;�bO%�(c�����Ba���ϧC�6-i�?�ZH��r�( V��-�]E�I~(rY0�km�Jo��J�lQ�|���0R+�X�l Pcw8���g���.*�Q�� &VX�L��ڻ��,���XRh�O�Ml�u�A��yq����q������<�S<��q ��e��v�)t�}o�ux{�J3`[��T� �S�uUe[�����5���۱}Ϟ[�]�1�ݸ%�ԜT^B4 RA0N��f��Y2/8�ެ�O�!���Pڳǹ��*Y�����^=���4p��|��;Xd_j���~zq'3X|ǒ��ѝ��|H�$�`��o�tj\�,1��\�8 Br�(�ްd��|.�����o��\ pj����)�g�[={ky[h<�|��E�ua�Y~�� �;�LEf��LȜ�&�;�@���>���n��3Jhk�)m-�������a��{�N�Td��e�v�_1B�����Y��x�Xl���1x�%��H�@:�A�Xr��T�����G��'{�mb��R�\�
Behavioral task
behavioral1
Sample
NEAS.3c956cafb5feea2b185bab435b230050.exe
Resource
win7-20231020-en
General
-
Target
NEAS.3c956cafb5feea2b185bab435b230050.exe
-
Size
2.5MB
-
MD5
3c956cafb5feea2b185bab435b230050
-
SHA1
48fd364430361258a8634b71a734c9cd98a0d592
-
SHA256
1f556dae28f5275261267dd0754a94851f5fb339676aae87e13b33847ae49f35
-
SHA512
3063e431eface3e0187a2e3a5442003d34f5aea7195d210c5157d87e0624366bc8252abd7336d517cb2a2868e9e766a886d053834945c9cee3636182f819ce28
-
SSDEEP
49152:H36q1vJkMl0+x7yFyBL1S2R0n5wbSQ2tTODJL8qzqcx7XBPBxVU0Kl3gQqmUmwqV:H3d1Bk47yFOane72ti9L8qznx7XBPBxI
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3c956cafb5feea2b185bab435b230050.exe
Files
-
NEAS.3c956cafb5feea2b185bab435b230050.exe.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 41KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ