Behavioral task
behavioral1
Sample
NEAS.a3998ac7b41d11f70bba9c6086001b00_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a3998ac7b41d11f70bba9c6086001b00_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.a3998ac7b41d11f70bba9c6086001b00_JC.exe
-
Size
5.1MB
-
MD5
a3998ac7b41d11f70bba9c6086001b00
-
SHA1
f5889899ca5b0ce577d863faae4003bfd3931fea
-
SHA256
8049535bb1efad42c11c8d34ca50cb1935a682fd1d7daa98c430bcb8b6fd5206
-
SHA512
bb351c3d0b5f95ad9fde0c7b4c71c105d827cd10c19eb329d29b1fdb4823293976dcf80e2e8de97e3d075ef622296daf333dd46ae30ebd4a8c9705eb77801d17
-
SSDEEP
98304:eypqzKoCZ9vq7MDy48ARo/xVOS5SuQFwq4Zau7lGpX5DF90xbmh2wYD/z+l7GJq/:eypqzKoCZ9vq7MDy48ARo/xVOS5SuQFl
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a3998ac7b41d11f70bba9c6086001b00_JC.exe
Files
-
NEAS.a3998ac7b41d11f70bba9c6086001b00_JC.exe.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 660KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 25KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ