General

  • Target

    5491c55ae49f285cfc4605bf8a9d6cd0N.exe

  • Size

    96KB

  • Sample

    240817-jf47aavamb

  • MD5

    5491c55ae49f285cfc4605bf8a9d6cd0

  • SHA1

    02efbbf4adc3cfca01a69ae57e3c261112df5ff8

  • SHA256

    08a6d48023bfb0bd20efc0c6f73d6ddeb1a33ca1024d3fa86583815ea31dfe48

  • SHA512

    a3dff1d1580917f4b3d0ea3a30c80061e2522a9a7eafafcfb521a311aba3e20eedec325a86380e6e6d5f9232c808f20f73f062ee48a9ec9ec09732eeaf54c2ad

  • SSDEEP

    1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:fGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      5491c55ae49f285cfc4605bf8a9d6cd0N.exe

    • Size

      96KB

    • MD5

      5491c55ae49f285cfc4605bf8a9d6cd0

    • SHA1

      02efbbf4adc3cfca01a69ae57e3c261112df5ff8

    • SHA256

      08a6d48023bfb0bd20efc0c6f73d6ddeb1a33ca1024d3fa86583815ea31dfe48

    • SHA512

      a3dff1d1580917f4b3d0ea3a30c80061e2522a9a7eafafcfb521a311aba3e20eedec325a86380e6e6d5f9232c808f20f73f062ee48a9ec9ec09732eeaf54c2ad

    • SSDEEP

      1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:fGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks