General

  • Target

    906a611daf751e75d6f811a92159c8a0N.exe

  • Size

    248KB

  • Sample

    240727-e2tv8azgmb

  • MD5

    906a611daf751e75d6f811a92159c8a0

  • SHA1

    97cc29933d2cef43a42cb32243503b870aa31e1b

  • SHA256

    235f540bc6fd775a3eaac29aa64d37ad70fa0a694e3e7da7131d85989e0ed513

  • SHA512

    d0ea054b46a8548d44969ccc5560d8c4c7680cd50e56e1124ee229b835cf92c7776bf96be35a4b33d339b50263e254cb77b35d758b5024f39aa9f11118fc7c78

  • SSDEEP

    1536:/4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:/IdseIO+EZEyFjEOFqTiQmGnOHjzU

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      906a611daf751e75d6f811a92159c8a0N.exe

    • Size

      248KB

    • MD5

      906a611daf751e75d6f811a92159c8a0

    • SHA1

      97cc29933d2cef43a42cb32243503b870aa31e1b

    • SHA256

      235f540bc6fd775a3eaac29aa64d37ad70fa0a694e3e7da7131d85989e0ed513

    • SHA512

      d0ea054b46a8548d44969ccc5560d8c4c7680cd50e56e1124ee229b835cf92c7776bf96be35a4b33d339b50263e254cb77b35d758b5024f39aa9f11118fc7c78

    • SSDEEP

      1536:/4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:/IdseIO+EZEyFjEOFqTiQmGnOHjzU

    • Neconyd

      Neconyd is a trojan written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Tasks