neconyd | 533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97

Sharing

Copy URL Twitter E-mail

General

Target
533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97
Size 76KB
Sample240613-2t4f1stflg
SHA256 533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97
MD5 d03bf01a68f12c227981a5685494dbf0
SHA1 d3cd1fa2c4ac48d1d35026c1792cadd29c79b7af
SHA512 ebb8ed3218898c66ce716c7a18c150eaa900b81f535f2626e876b9218fee3d1a23d070d253383c24b08e98fb32501abf00ac2324635143f0e8d88afb2df54f32
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:BdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd family
neconyd

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97

File Explorer

533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97

.exe 76KB

533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97

IMPHASH 08b67a9663d3a8c9505f3b2561bbdd1c
SHA256 533301b54cf0ef69842a4ea9592e5ca39c85d010cc98f9725c64b595b4b99e97
MD5 d03bf01a68f12c227981a5685494dbf0
SHA1 d3cd1fa2c4ac48d1d35026c1792cadd29c79b7af
SHA512 ebb8ed3218898c66ce716c7a18c150eaa900b81f535f2626e876b9218fee3d1a23d070d253383c24b08e98fb32501abf00ac2324635143f0e8d88afb2df54f32
SSDEEP 1536:xd9dseIOcE93bIvYvZEyF4EEOF6N4XS+AQmZTl/5w11:BdseIOMEZEyFjEOFqaiQm5l/5w11
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

HttpSendRequestW InternetConnectW HttpOpenRequestW InternetSetPerSiteCookieDecisionW InternetOpenUrlW InternetAttemptConnect InternetOpenW InternetReadFile InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW

shlwapi

StrStrIW PathMatchSpecW PathCombineW wvnsprintfW StrStrIA PathRemoveFileSpecW

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapReAlloc RtlUnwind WideCharToMultiByte MultiByteToWideChar HeapCreate CopyFileW CreateThread WaitForMultipleObjects GetTickCount DeleteFileW CreateProcessW SetUnhandledExceptionFilter ExitProcess GetLastError LoadLibraryW GetProcAddress Sleep VirtualProtect GetPrivateProfileIntW ExpandEnvironmentStringsW GetPrivateProfileStringW FindFirstFileW SetFilePointer SetEndOfFile GetVersionExW HeapAlloc SetWaitableTimer SystemTimeToFileTime CreateWaitableTimerW FindNextFileW HeapFree ReadFile GetModuleFileNameW GetFileTime WaitForSingleObject GetTimeZoneInformation CreateFileW CloseHandle GetFileSizeEx VirtualFree GetProcessHeap GetCurrentDirectoryW VirtualAlloc VirtualQuery GetSystemTime GetFileSize FindClose WriteFile GetLocalTime GetModuleHandleW GetCommandLineW

user32

GetWindowLongW DispatchMessageW GetForegroundWindow CharLowerW CreateWindowExW FindWindowW PeekMessageW SetForegroundWindow GetSystemMetrics MessageBoxW SetWindowPos SetWindowLongW SetParent

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance OleInitialize CoInitialize

oleaut32

SysFreeString VariantInit SysAllocString VariantClear