Behavioral task
behavioral1
Sample
7fe4ee35b231a57981d50ee6cb1b7f70_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
7fe4ee35b231a57981d50ee6cb1b7f70_NEIKI
-
Size
449KB
-
MD5
7fe4ee35b231a57981d50ee6cb1b7f70
-
SHA1
fae0ff173b5120229e478466854ac968dfa4a655
-
SHA256
44b92decc7a364bb50fea1298aefb226f4c01d5790cb24aef0e611034fe74fac
-
SHA512
fdb869c6d26153f1a9b4442e36473278401e1c9c89204767629b0ae62eaf522e837a280691fa49c2cc266b4a2769ecc14d1c1ff2900f30c6a7d84259ba029302
-
SSDEEP
12288:64wFHoSJ1zBR/p2r8Cnkhdar2oGNLty6SDXaXIKJcnsjs0STADuO1ve5yqhb:MtBR/Mr8Cnkhdar2oGNLty6SDXaXIKJG
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7fe4ee35b231a57981d50ee6cb1b7f70_NEIKI
Files
-
7fe4ee35b231a57981d50ee6cb1b7f70_NEIKI.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ