Overview

overview

10

Static

static

10

2120859dd3...cs.exe

windows7-x64

10

2120859dd3...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe

  • Size

    224KB

  • Sample

    240527-gf8hlaaa8x

  • MD5

    2120859dd39a69c9a4537f402bd2dec0

  • SHA1

    0a223d32a9f2e8df0d07081f03526bfbe295eda7

  • SHA256

    2ddc3dfbae859ffc160a09b54b02aad7906fcfba8f554b1878b759e7baae086b

  • SHA512

    88ac51a05615e35262272cdc06fbd2b61110c9f2f50a750ffccc3fd1e0b10d2f60d6a1680fa6eef365ba12964cc3ac356f8db1f19724c0bddb90bef1acb65844

  • SSDEEP

    6144:KUSiZTK40lUHTisQt9Nd1Kid908edttRURLwe:KUvRK4ZusQHNd1KidKjttRYLwe

Score
10/10
berbewbackdoordroppertrojanupx

Malware Config

Targets

    • Target

      2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe

    • Size

      224KB

    • MD5

      2120859dd39a69c9a4537f402bd2dec0

    • SHA1

      0a223d32a9f2e8df0d07081f03526bfbe295eda7

    • SHA256

      2ddc3dfbae859ffc160a09b54b02aad7906fcfba8f554b1878b759e7baae086b

    • SHA512

      88ac51a05615e35262272cdc06fbd2b61110c9f2f50a750ffccc3fd1e0b10d2f60d6a1680fa6eef365ba12964cc3ac356f8db1f19724c0bddb90bef1acb65844

    • SSDEEP

      6144:KUSiZTK40lUHTisQt9Nd1Kid908edttRURLwe:KUvRK4ZusQHNd1KidKjttRYLwe

    Score
    10/10
    backdoordroppertrojanupx

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks