Behavioral task
behavioral1
Sample
84e54db542b7a94f646c5e16538c4140_NEIKI.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
84e54db542b7a94f646c5e16538c4140_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
84e54db542b7a94f646c5e16538c4140_NEIKI
-
Size
391KB
-
MD5
84e54db542b7a94f646c5e16538c4140
-
SHA1
7da5cfcf37fba9d09c62e69eb271b79dc398c45a
-
SHA256
41047459e406169a666899a56cfbe0956087d6573852e9ec117146b6c31c0cef
-
SHA512
873ca56c1bea8b30a4106cec3b992d49c0e292331f597b758f0fcabb797799d0e0cc4b65230d1effc073c9071242cb7a8fba7b7423d0efea39ca356f1b15f83d
-
SSDEEP
12288:kp7y4FrT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:Q7yGP9XvEhdfJkKSkU3kHyuaRB5t6k0F
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84e54db542b7a94f646c5e16538c4140_NEIKI
Files
-
84e54db542b7a94f646c5e16538c4140_NEIKI.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 122KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ajelhf Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ