Behavioral task
behavioral1
Sample
aadb086304ed1619c04cc595addeab4b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
aadb086304ed1619c04cc595addeab4b.exe
Resource
win10v2004-20231215-en
General
-
Target
aadb086304ed1619c04cc595addeab4b.exe
-
Size
378KB
-
MD5
aadb086304ed1619c04cc595addeab4b
-
SHA1
5cd7ac007b752f482da5a6d2f7db8270a5f4c316
-
SHA256
157979d628786120ba94de77f3e37f1996a6c2dd02053affbfe3df6b29dac825
-
SHA512
f5bb8facfc3d82c4ac724ac03046fb9057cbc48eeb9031f00356bcc5bbbbe9d5bef747743b18bb0ccf2156c4d0edfa78f8562cebffae11eafb16272c2ab72324
-
SSDEEP
6144:Q/RmHOKChiGvprtMsQBma/atn9pG4l+0K76zHTgb8ecFeK8TJ4u392vVAMR4/5Vm:YKVCtRMsEat9pG4l+0K7WHT91M52vVAu
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aadb086304ed1619c04cc595addeab4b.exe
Files
-
aadb086304ed1619c04cc595addeab4b.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kofbl Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.l1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ