General

  • Target

    779a2a6d6661f4041fd3125ba627955c96cff9fb0929632bc7e4fe960336b8c4N.exe

  • Size

    96KB

  • Sample

    241130-vphv7atlhr

  • MD5

    44e119256f80dc9a7d0e8c9a68a6f1f0

  • SHA1

    6547b47e6252fca2e7fec300aa36a9cd654a89d2

  • SHA256

    779a2a6d6661f4041fd3125ba627955c96cff9fb0929632bc7e4fe960336b8c4

  • SHA512

    16e872ba70f05d1d81c632b722326063b713a943cabb22bec50914fdfb46a2d7f85bde1ff781b38dc0777076c9d4ecfbce6605dc5f6ce7b808dd164e499f6b54

  • SSDEEP

    1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:OGs8cd8eXlYairZYqMddH137

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      779a2a6d6661f4041fd3125ba627955c96cff9fb0929632bc7e4fe960336b8c4N.exe

    • Size

      96KB

    • MD5

      44e119256f80dc9a7d0e8c9a68a6f1f0

    • SHA1

      6547b47e6252fca2e7fec300aa36a9cd654a89d2

    • SHA256

      779a2a6d6661f4041fd3125ba627955c96cff9fb0929632bc7e4fe960336b8c4

    • SHA512

      16e872ba70f05d1d81c632b722326063b713a943cabb22bec50914fdfb46a2d7f85bde1ff781b38dc0777076c9d4ecfbce6605dc5f6ce7b808dd164e499f6b54

    • SSDEEP

      1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:OGs8cd8eXlYairZYqMddH137

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks