Behavioral task
behavioral1
Sample
3baf5595434447d39279e14bb6144050_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
3baf5595434447d39279e14bb6144050_NEIKI
-
Size
768KB
-
MD5
3baf5595434447d39279e14bb6144050
-
SHA1
55460414bf8c788dba59a75b030b84001ccc6395
-
SHA256
377efb0e9115b4c3c580552a1eeee403ad340d6e702a8e1be7ab2883152aea73
-
SHA512
bb92b956c5ff94d40a8c0e5c74279d4f06fddf68fc70ca04d183de852191be73376216ed16e78dbf9daf82ffa0f7ed307b51534c5a5e2b72d3f642bab90c9592
-
SSDEEP
24576:qW298E8u8XBC51CEfP4AKgzyw0ZN+pUdGOvCJw26cV/JKuylm69T:a98E8uIBq1P4AKgzyw0ZN+pUdGECJwNZ
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3baf5595434447d39279e14bb6144050_NEIKI
Files
-
3baf5595434447d39279e14bb6144050_NEIKI.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 219KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ