Behavioral task
behavioral1
Sample
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe
-
Size
329KB
-
MD5
1b0d9c6ed23852de54ff9e18db778470
-
SHA1
b444e900fc5ab31a71564519bc3f00e84ebd9e9a
-
SHA256
9b256baffab58b009b05489e753e2c8aa8141411113c75d87fdc956a2070d87c
-
SHA512
ccd49b0566ed5ced043affcdbd8477883138406af7c7fc37dc0aae7be8e7a08a6c7f22211cbe00a6f3d65d6f400a4e374bca0716d8198256b191dc247413a337
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhh:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTR
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule sample family_berbew -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe
Files
-
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.rsrc Size: 40KB - Virtual size: 152KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 2KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ