General

  • Target

    aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118

  • Size

    128KB

  • Sample

    241128-rnva2swkbr

  • MD5

    aca1443b1acfdd03ddb28221b5b9de28

  • SHA1

    1570e650764203e0f9775b3a5c0f5876f1501697

  • SHA256

    ef5315a288a29fadc0b5a9832641492f8cd9a8b99279a133faef3d22bee9b8de

  • SHA512

    a90aa5da8b9d7677749b25d0c93e8b6b3ad2722135cb946ba16be5ebb00a85b1c5f3da086f66780d914507f4cac4eabbbdbce1bd0a06c08491440e4e413c2983

  • SSDEEP

    1536:HDfDbhERTatPLTLLbC+8BMNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabau:jiRTe3n8BMAW6J6f1tqF6dngNmaZrN

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      aca1443b1acfdd03ddb28221b5b9de28_JaffaCakes118

    • Size

      128KB

    • MD5

      aca1443b1acfdd03ddb28221b5b9de28

    • SHA1

      1570e650764203e0f9775b3a5c0f5876f1501697

    • SHA256

      ef5315a288a29fadc0b5a9832641492f8cd9a8b99279a133faef3d22bee9b8de

    • SHA512

      a90aa5da8b9d7677749b25d0c93e8b6b3ad2722135cb946ba16be5ebb00a85b1c5f3da086f66780d914507f4cac4eabbbdbce1bd0a06c08491440e4e413c2983

    • SSDEEP

      1536:HDfDbhERTatPLTLLbC+8BMNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabau:jiRTe3n8BMAW6J6f1tqF6dngNmaZrN

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks