neconyd | 16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd

Sharing

Copy URL Twitter E-mail

General

Target
16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd
Size 92KB
Sample240519-xp84gsda7t
SHA256 16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd
MD5 d778c5f619c010fb474b77763cd5e2a4
SHA1 15fc99ce1104d3e522a14b1e670fb79e64f4a32c
SHA512 aeca53c4e3f361c90b119ffd0a44d6d491fd72e2865358131edea6a86a185ae2a6f0d470d6351768d71fe1d5e842828a129c174f4d2b191810d198ff07b23205
SSDEEP 1536:pd9dseIOcEE3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:pdseIO/EZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd family
neconyd

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd

File Explorer

16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd

.exe 92KB

16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd

IMPHASH 08b67a9663d3a8c9505f3b2561bbdd1c
SHA256 16cd8fc0620e6eb5a8d341d0ce8b3bc8d7a6861e3eda2e4492bd6d5bc9645cdd
MD5 d778c5f619c010fb474b77763cd5e2a4
SHA1 15fc99ce1104d3e522a14b1e670fb79e64f4a32c
SHA512 aeca53c4e3f361c90b119ffd0a44d6d491fd72e2865358131edea6a86a185ae2a6f0d470d6351768d71fe1d5e842828a129c174f4d2b191810d198ff07b23205
SSDEEP 1536:pd9dseIOcEE3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:pdseIO/EZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

HttpSendRequestW InternetConnectW HttpOpenRequestW InternetSetPerSiteCookieDecisionW InternetOpenUrlW InternetAttemptConnect InternetOpenW InternetReadFile InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW

shlwapi

StrStrIW PathMatchSpecW PathCombineW wvnsprintfW StrStrIA PathRemoveFileSpecW

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapReAlloc RtlUnwind WideCharToMultiByte MultiByteToWideChar HeapCreate CopyFileW CreateThread WaitForMultipleObjects GetTickCount DeleteFileW CreateProcessW SetUnhandledExceptionFilter ExitProcess GetLastError LoadLibraryW GetProcAddress Sleep VirtualProtect GetPrivateProfileIntW ExpandEnvironmentStringsW GetPrivateProfileStringW FindFirstFileW SetFilePointer SetEndOfFile GetVersionExW HeapAlloc SetWaitableTimer SystemTimeToFileTime CreateWaitableTimerW FindNextFileW HeapFree ReadFile GetModuleFileNameW GetFileTime WaitForSingleObject GetTimeZoneInformation CreateFileW CloseHandle GetFileSizeEx VirtualFree GetProcessHeap GetCurrentDirectoryW VirtualAlloc VirtualQuery GetSystemTime GetFileSize FindClose WriteFile GetLocalTime GetModuleHandleW GetCommandLineW

user32

GetWindowLongW DispatchMessageW GetForegroundWindow CharLowerW CreateWindowExW FindWindowW PeekMessageW SetForegroundWindow GetSystemMetrics MessageBoxW SetWindowPos SetWindowLongW SetParent

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance OleInitialize CoInitialize

oleaut32

SysFreeString VariantInit SysAllocString VariantClear