General

  • Target

    8b9e7d9b5e71a015ad0f1701a45ddea0N.exe

  • Size

    248KB

  • Sample

    240903-n6mr5sxcnf

  • MD5

    8b9e7d9b5e71a015ad0f1701a45ddea0

  • SHA1

    2d6871d4ae01569b3e8d8c7e5685602c765b3904

  • SHA256

    0018392696a4d5cd58bd377dfb62839e5f131abe3ccd59a18be3ed85a88e0482

  • SHA512

    1d1e8f23a7fb6fed3a2ce6ab2757921c823dcf023034736693c88428703169fa6b7df7467221e9d2c518f0841a7215c5450e5af34f1ee8fde2cb99a6468e920f

  • SSDEEP

    1536:L4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:LIdseIO+EZEyFjEOFqTiQmGnOHjzU

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      8b9e7d9b5e71a015ad0f1701a45ddea0N.exe

    • Size

      248KB

    • MD5

      8b9e7d9b5e71a015ad0f1701a45ddea0

    • SHA1

      2d6871d4ae01569b3e8d8c7e5685602c765b3904

    • SHA256

      0018392696a4d5cd58bd377dfb62839e5f131abe3ccd59a18be3ed85a88e0482

    • SHA512

      1d1e8f23a7fb6fed3a2ce6ab2757921c823dcf023034736693c88428703169fa6b7df7467221e9d2c518f0841a7215c5450e5af34f1ee8fde2cb99a6468e920f

    • SSDEEP

      1536:L4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZMnOHBRzU:LIdseIO+EZEyFjEOFqTiQmGnOHjzU

    • Neconyd

      Neconyd is a trojan written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks