Behavioral task
behavioral1
Sample
NEAS.1d291c5e9f8187084fc8473816a16140.exe
Resource
win7-20231025-en
General
-
Target
NEAS.1d291c5e9f8187084fc8473816a16140.exe
-
Size
1.7MB
-
MD5
1d291c5e9f8187084fc8473816a16140
-
SHA1
dd7df83de6a744d7b9ede97a6677970adeb9e80b
-
SHA256
7157a29e35a1065a79e3989713e59c0c5e89820222ed82fe017e3effe4104be2
-
SHA512
f147fae6956faf1c175c97440989e5bdbac1a52a0b1a006b389e5287564af7d61a824fd198a000abd8ad813a68683293c0e08b2e86f822714390f034fee80f64
-
SSDEEP
49152:1mImJE/xsKkO3xrEffdTITCO59BnAbyvBLwWBDh8J7fiBfmslNMxU:IIbJeQYffdTCCkxAevBLwWBDh8J7fiBH
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.1d291c5e9f8187084fc8473816a16140.exe
Files
-
NEAS.1d291c5e9f8187084fc8473816a16140.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE