Behavioral task
behavioral1
Sample
NEAS.a28a408514ce8cd53783fd073fa79b40.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a28a408514ce8cd53783fd073fa79b40.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.a28a408514ce8cd53783fd073fa79b40.exe
-
Size
256KB
-
MD5
a28a408514ce8cd53783fd073fa79b40
-
SHA1
e84ba235de4aee6f6181b49b21acd492f52b9bfd
-
SHA256
2ef284655c0386530f2b679af12e54429a3fc16ac39c6006c3a8811b8ff88e1f
-
SHA512
90c9b4bec881bcb1c6393e6f02da2f508a6ceae1bae598d22f6f50924a039974ade1242630974ce9e2eb35b6aa601c159e996da88dd5e04cef21da6059fa2c41
-
SSDEEP
3072:EfbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjrtHKaGKRejorRVKWI1uaaMRc8:Vdw3Wi2T2tPPEZzpHPzRej6z0u2u8
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a28a408514ce8cd53783fd073fa79b40.exe
Files
-
NEAS.a28a408514ce8cd53783fd073fa79b40.exe.exe windows:5 windows x86 arch:x86
bc8d65d747efa0c4d0902c912ff2f1fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
CreateMutexA
GetLastError
CloseHandle
Sleep
CreateDirectoryA
WaitForSingleObject
TerminateThread
GetTickCount
CreateFileA
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
ExitProcess
SetLastError
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
IsWow64Process
GetCurrentProcess
InterlockedDecrement
WideCharToMultiByte
SetEndOfFile
CreateFileW
SetEnvironmentVariableA
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryW
OutputDebugStringW
SetFilePointer
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
GetFileType
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
lstrlenA
LocalFree
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
HeapSize
user32
GetForegroundWindow
GetShellWindow
GetWindowRect
GetCursorPos
GetSystemMetrics
GetDesktopWindow
ole32
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
VariantClear
ws2_32
send
closesocket
WSACleanup
connect
htons
gethostbyname
socket
WSAStartup
recv
WSAGetLastError
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ