Behavioral task
behavioral1
Sample
db32e26c3c0a226a1601a3687dd190d0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
db32e26c3c0a226a1601a3687dd190d0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
db32e26c3c0a226a1601a3687dd190d0_NeikiAnalytics
-
Size
235KB
-
MD5
db32e26c3c0a226a1601a3687dd190d0
-
SHA1
b9b8c50ed8fc01a1962cbf7f652201efb3d93312
-
SHA256
38663ab0968977253e9ef500255c7ffce1ed5293b8ed01dbebb7944a5e7640b2
-
SHA512
c6ea5123ee33ab56e1add81d1da32d7b5533e8aae9d274b0a4ca9a04eaf67112bc7c670955e6dd5536a68001da97f0e1c9683473fec25aff3634bbe51aca5665
-
SSDEEP
3072:i/w96F6DwdjtqQjR0pM4/FtHOVMgu+tAcrbFAJc+RsUi1aVDkOvhJjvJ4vnZy7LJ:uw9W+FtulrtMsQB+vn87L5A5
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db32e26c3c0a226a1601a3687dd190d0_NeikiAnalytics
Files
-
db32e26c3c0a226a1601a3687dd190d0_NeikiAnalytics.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 132KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.l1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ