Behavioral task
behavioral1
Sample
NEAS.add421791fe7196dfe376670a60cce30.exe
Resource
win7-20231020-en
General
-
Target
NEAS.add421791fe7196dfe376670a60cce30.exe
-
Size
463KB
-
MD5
add421791fe7196dfe376670a60cce30
-
SHA1
9671388f4e1bfce57fe09bbc3b604d30ad7784b5
-
SHA256
a412f527b0f6cc15b09cc06aa44b8b8a5bf1c3418e9dc2c34f9efbf52e8bb8c4
-
SHA512
42d067b6518d41495e4d07c536cc2808129adad04fa669dc7b42f8e16ae70260fb342701906446072e0da5b702f5020f33780d6d71caee10f39493a5a72cfa10
-
SSDEEP
12288:j7TcHWj16thri4gfkDVmuXWOPWHxxcL6k:/h6thrLg8BmuXWOPWHxxcL6k
Malware Config
Signatures
-
Berbew family
-
Malware Backdoor - Berbew 1 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.add421791fe7196dfe376670a60cce30.exe
Files
-
NEAS.add421791fe7196dfe376670a60cce30.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
petite Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ