General

  • Target

    45459a0c5aa7152d25349da8fd9bb14db5895dfb603d5d92fbb40e9a42e35502

  • Size

    96KB

  • Sample

    241123-1rwsqaykfz

  • MD5

    fc8b0560cc05b613073e22659087a215

  • SHA1

    1e531095386059a001b9118c1f2a8127493fb1d5

  • SHA256

    45459a0c5aa7152d25349da8fd9bb14db5895dfb603d5d92fbb40e9a42e35502

  • SHA512

    966e0eb2a3de252f3a8f10316d080f6d679ce864c816d483b48f925f1c7deda6d3c8fd38b65c495a2d672e4c4a49e7d37894267a994243be383c1c46deaa4c3a

  • SSDEEP

    1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:BGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      45459a0c5aa7152d25349da8fd9bb14db5895dfb603d5d92fbb40e9a42e35502

    • Size

      96KB

    • MD5

      fc8b0560cc05b613073e22659087a215

    • SHA1

      1e531095386059a001b9118c1f2a8127493fb1d5

    • SHA256

      45459a0c5aa7152d25349da8fd9bb14db5895dfb603d5d92fbb40e9a42e35502

    • SHA512

      966e0eb2a3de252f3a8f10316d080f6d679ce864c816d483b48f925f1c7deda6d3c8fd38b65c495a2d672e4c4a49e7d37894267a994243be383c1c46deaa4c3a

    • SSDEEP

      1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:BGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks