General

  • Target

    0bf5a6f651f91d8f3f54fb1432423cd35329b483c3b6d8a9ec9ec5a08f1a3c28

  • Size

    248KB

  • Sample

    240817-xgbs1s1brf

  • MD5

    7dd2d58d7e183cb788b43c75a6df7e40

  • SHA1

    11f4bda8131fe9882041a3b380e18c3d07622231

  • SHA256

    0bf5a6f651f91d8f3f54fb1432423cd35329b483c3b6d8a9ec9ec5a08f1a3c28

  • SHA512

    bf54f13adf60f14cbcbe00b75a0b3a97d24aac0cce7135fa7c47edbbdd5badc0c9322ea4f2da92cba96c143f6775e12111193d4b851cebf6c38055e936538225

  • SSDEEP

    1536:74d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:7IdseIO+EZEyFjEOFqTiQmGnOHjzU

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      0bf5a6f651f91d8f3f54fb1432423cd35329b483c3b6d8a9ec9ec5a08f1a3c28

    • Size

      248KB

    • MD5

      7dd2d58d7e183cb788b43c75a6df7e40

    • SHA1

      11f4bda8131fe9882041a3b380e18c3d07622231

    • SHA256

      0bf5a6f651f91d8f3f54fb1432423cd35329b483c3b6d8a9ec9ec5a08f1a3c28

    • SHA512

      bf54f13adf60f14cbcbe00b75a0b3a97d24aac0cce7135fa7c47edbbdd5badc0c9322ea4f2da92cba96c143f6775e12111193d4b851cebf6c38055e936538225

    • SSDEEP

      1536:74d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:7IdseIO+EZEyFjEOFqTiQmGnOHjzU

    • Neconyd

      Neconyd is a trojan written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks