Behavioral task
behavioral1
Sample
2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe
-
Size
224KB
-
MD5
2120859dd39a69c9a4537f402bd2dec0
-
SHA1
0a223d32a9f2e8df0d07081f03526bfbe295eda7
-
SHA256
2ddc3dfbae859ffc160a09b54b02aad7906fcfba8f554b1878b759e7baae086b
-
SHA512
88ac51a05615e35262272cdc06fbd2b61110c9f2f50a750ffccc3fd1e0b10d2f60d6a1680fa6eef365ba12964cc3ac356f8db1f19724c0bddb90bef1acb65844
-
SSDEEP
6144:KUSiZTK40lUHTisQt9Nd1Kid908edttRURLwe:KUvRK4ZusQHNd1KidKjttRYLwe
Malware Config
Signatures
-
Berbew family
-
Malware Dropper & Backdoor - Berbew 1 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule sample family_berbew -
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe
Files
-
2120859dd39a69c9a4537f402bd2dec0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE