Behavioral task
behavioral1
Sample
241cceeae19bdf5df79fdf2a89c86b9045c3ec5ffa18ba2743b7ca15b539d72b.exe
Resource
win7-20240705-en
General
-
Target
241cceeae19bdf5df79fdf2a89c86b9045c3ec5ffa18ba2743b7ca15b539d72b
-
Size
35KB
-
MD5
99fd5564b0fb45bc284295aa4a708213
-
SHA1
f0518dd42978dd4932a3cae64799405cd44eb212
-
SHA256
241cceeae19bdf5df79fdf2a89c86b9045c3ec5ffa18ba2743b7ca15b539d72b
-
SHA512
e658a5eb831c88d14680916dd1a68de55c1f73dca48f7f53780249911dd1121d72a17a5f57bfa8e7d7a0e1f9647af91089ba702bbf2fdaba1a5c963b2b0e1fcc
-
SSDEEP
768:S6vjVmakOElpmAsUA7DJHrhto2OsgwAPTUrpiEe7HpB:B8Z0kA7FHlO2OwOTUtKjpB
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 241cceeae19bdf5df79fdf2a89c86b9045c3ec5ffa18ba2743b7ca15b539d72b unpack001/out.upx
Files
-
241cceeae19bdf5df79fdf2a89c86b9045c3ec5ffa18ba2743b7ca15b539d72b.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 34KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.htext Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE