General

  • Target

    a2a9bc05a17f1cdce623b4003140876adccd3b7168b83b8ea9865ed792b74b1cN.exe

  • Size

    96KB

  • Sample

    241201-p39m6swnbm

  • MD5

    29807b887ed6d3269d66270ffe028030

  • SHA1

    2f02bbff135c5a402618b7c25f377f7bd7ceca3e

  • SHA256

    a2a9bc05a17f1cdce623b4003140876adccd3b7168b83b8ea9865ed792b74b1c

  • SHA512

    9187b1944d2e8a92610519acb62e58eb693b04d346e29e8875c7155230e81abbd84189c7f59275b177208ba97ac84ad20ee55672dc015cf6fd40a92da6673db0

  • SSDEEP

    1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:WGs8cd8eXlYairZYqMddH13r

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      a2a9bc05a17f1cdce623b4003140876adccd3b7168b83b8ea9865ed792b74b1cN.exe

    • Size

      96KB

    • MD5

      29807b887ed6d3269d66270ffe028030

    • SHA1

      2f02bbff135c5a402618b7c25f377f7bd7ceca3e

    • SHA256

      a2a9bc05a17f1cdce623b4003140876adccd3b7168b83b8ea9865ed792b74b1c

    • SHA512

      9187b1944d2e8a92610519acb62e58eb693b04d346e29e8875c7155230e81abbd84189c7f59275b177208ba97ac84ad20ee55672dc015cf6fd40a92da6673db0

    • SSDEEP

      1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:WGs8cd8eXlYairZYqMddH13r

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks