General

  • Target

    04e9b625581c9feeab28baae5d98fdb91fea2638cb7bfd4d9884c4a7ff8d516f

  • Size

    96KB

  • Sample

    241130-xw9ctsskdw

  • MD5

    f16d48d2e484c261b18b4bc51e3e8e67

  • SHA1

    33ccefea7655343fb83df731d96546cb39f7395f

  • SHA256

    04e9b625581c9feeab28baae5d98fdb91fea2638cb7bfd4d9884c4a7ff8d516f

  • SHA512

    ff7155e5f2ed84a04192370b0cd1491e183e7ad51c75ba334f60019a376b6f2ef8c366c3ef65f4b1fa4d211f26d73ea25d956451f31f980d32eb4b4ba864c477

  • SSDEEP

    1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxR:TGs8cd8eXlYairZYqMddH13R

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      04e9b625581c9feeab28baae5d98fdb91fea2638cb7bfd4d9884c4a7ff8d516f

    • Size

      96KB

    • MD5

      f16d48d2e484c261b18b4bc51e3e8e67

    • SHA1

      33ccefea7655343fb83df731d96546cb39f7395f

    • SHA256

      04e9b625581c9feeab28baae5d98fdb91fea2638cb7bfd4d9884c4a7ff8d516f

    • SHA512

      ff7155e5f2ed84a04192370b0cd1491e183e7ad51c75ba334f60019a376b6f2ef8c366c3ef65f4b1fa4d211f26d73ea25d956451f31f980d32eb4b4ba864c477

    • SSDEEP

      1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxR:TGs8cd8eXlYairZYqMddH13R

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks