General

  • Target

    f2a4d64a0d9aa0dee4e98b0d2099e94fc62211eda72329960deaeb865131357eN.exe

  • Size

    96KB

  • Sample

    241130-klcvnatnfp

  • MD5

    af6119db2aab92ae41d30664b84f3670

  • SHA1

    61939f02faaa197504b9630be8d7e6e75c49654b

  • SHA256

    f2a4d64a0d9aa0dee4e98b0d2099e94fc62211eda72329960deaeb865131357e

  • SHA512

    12b86225feb6a4819cecf045e26d11952c998c270111ee8e8dfb2708ff8d779c91545fc98db60ff52fec86378b7bb9d54303a2f725fdb292f5b00746865c996d

  • SSDEEP

    1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:bGs8cd8eXlYairZYqMddH137

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      f2a4d64a0d9aa0dee4e98b0d2099e94fc62211eda72329960deaeb865131357eN.exe

    • Size

      96KB

    • MD5

      af6119db2aab92ae41d30664b84f3670

    • SHA1

      61939f02faaa197504b9630be8d7e6e75c49654b

    • SHA256

      f2a4d64a0d9aa0dee4e98b0d2099e94fc62211eda72329960deaeb865131357e

    • SHA512

      12b86225feb6a4819cecf045e26d11952c998c270111ee8e8dfb2708ff8d779c91545fc98db60ff52fec86378b7bb9d54303a2f725fdb292f5b00746865c996d

    • SSDEEP

      1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:bGs8cd8eXlYairZYqMddH137

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks