Behavioral task
behavioral1
Sample
465bae00392f01be520365fc59b26920_NEIKI.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
465bae00392f01be520365fc59b26920_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
465bae00392f01be520365fc59b26920_NEIKI
-
Size
283KB
-
MD5
465bae00392f01be520365fc59b26920
-
SHA1
8d7d3eb0aa23cf868336ce1360ce0886f10241da
-
SHA256
af4998312ad43e8f7ffb20722a7ba508382f343a129d8ebf5b2365b8ed07f1f2
-
SHA512
f4f5afe522decdc0e843f8c130cbdba4849ed40c2c285bc2753219ca83a1df99d16c90087122db7032381cd6c835a68cfc7404fc6d6662dcd53823e1d2682d58
-
SSDEEP
6144:VA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0LV8SZWpMG8SUtaBXAfi1:VATuTAnKGwUAW3ycQqgxZ/wMnSfFAfe
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 465bae00392f01be520365fc59b26920_NEIKI
Files
-
465bae00392f01be520365fc59b26920_NEIKI.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_UP_SYSTEM_ONLY
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ