Behavioral task
behavioral1
Sample
966b5c594233a278a503bd0745dab210_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
966b5c594233a278a503bd0745dab210_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
966b5c594233a278a503bd0745dab210_NeikiAnalytics
-
Size
276KB
-
MD5
966b5c594233a278a503bd0745dab210
-
SHA1
a5cc0bf12e17c66e5995fd7cc765840cc3b4c96f
-
SHA256
6e5cf1510f7a4b2aace2e943745fc43c2c3bd56280e3ec5d779472a4e62203a8
-
SHA512
483a35ad5451fcd698de857f0d97f721428c325ee4817f69cb63bcedb43007290c9d47263e117411c6d307905ff9d33d37438cd38d8aeb0f135a0607b22659b6
-
SSDEEP
6144:R0LFA/WS9ORLSdn7MUZst5qXsunbLwMddjPXmF6EC1LlzxAKN+xTU5AX/KXWZCK9:R8SOnR+pMUQunbpd/mF6ECJlzxAKN2Xh
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 966b5c594233a278a503bd0745dab210_NeikiAnalytics
Files
-
966b5c594233a278a503bd0745dab210_NeikiAnalytics.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfcd Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ