General

  • Target

    09afb7667e22448ea044edafb9a3529bc42f6df8470992e7502250a6a91c8c0bN.exe

  • Size

    96KB

  • Sample

    241126-f814jstlaq

  • MD5

    6ec723374a9c7a16855342d825a10340

  • SHA1

    fd646ee9fefa3e1b086530ee16e2f8bb0155d28f

  • SHA256

    09afb7667e22448ea044edafb9a3529bc42f6df8470992e7502250a6a91c8c0b

  • SHA512

    a4bc32813c9c05cb94ef30e4fd4bc533c80c19e503d47dc4ee7e4c1d7a5f9e64fbb94f651731121fd8ec60d491d118f5d2c877c2a00bffaa27fff8dfe6399cfe

  • SSDEEP

    1536:InAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:IGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      09afb7667e22448ea044edafb9a3529bc42f6df8470992e7502250a6a91c8c0bN.exe

    • Size

      96KB

    • MD5

      6ec723374a9c7a16855342d825a10340

    • SHA1

      fd646ee9fefa3e1b086530ee16e2f8bb0155d28f

    • SHA256

      09afb7667e22448ea044edafb9a3529bc42f6df8470992e7502250a6a91c8c0b

    • SHA512

      a4bc32813c9c05cb94ef30e4fd4bc533c80c19e503d47dc4ee7e4c1d7a5f9e64fbb94f651731121fd8ec60d491d118f5d2c877c2a00bffaa27fff8dfe6399cfe

    • SSDEEP

      1536:InAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:IGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks