Behavioral task
behavioral1
Sample
e4097944eaa0ec098ff4af9747b0fcfdf4fd17d1b693cb6d08016e83b11b4a24N.exe
Resource
win7-20240903-en
General
-
Target
e4097944eaa0ec098ff4af9747b0fcfdf4fd17d1b693cb6d08016e83b11b4a24N.exe
-
Size
364KB
-
MD5
a5b2a1456b08894a1c0b70e83fe134c0
-
SHA1
2636088b581ef2834f17d98b87b8e200584c8b5c
-
SHA256
e4097944eaa0ec098ff4af9747b0fcfdf4fd17d1b693cb6d08016e83b11b4a24
-
SHA512
88f778337d3a2dc8b79ed0b08c89857391556bf2db6b3e5bab7d53435c821ac9dc26d6bb30a91f1830f6dabbd717ec643619ca650ca43a62a98dce2f39db3706
-
SSDEEP
1536:6XzXF8CvrJ4PBhDP3516hjlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:6Xh8k6DP3H6hjltOrWKDBr+yJb
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Berbew family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4097944eaa0ec098ff4af9747b0fcfdf4fd17d1b693cb6d08016e83b11b4a24N.exe
Files
-
e4097944eaa0ec098ff4af9747b0fcfdf4fd17d1b693cb6d08016e83b11b4a24N.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfcd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.l1 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DUzfAGgU Size: 4KB - Virtual size: 4KB
ctNgtzZD Size: 28KB - Virtual size: 28KB
wGXKLHKi Size: 8KB - Virtual size: 8KB
CFGqoxIF Size: 4KB - Virtual size: 4KB
nKdoXYMi Size: 4KB - Virtual size: 4KB
TJJIMjvz Size: 4KB - Virtual size: 4KB
iEIjrkBs Size: 36KB - Virtual size: 36KB
nQpbKAbx Size: 4KB - Virtual size: 4KB
NvORJvdu Size: 20KB - Virtual size: 20KB
dHDrdXqv Size: 44KB - Virtual size: 44KB