General

  • Target

    0103c8b2dc025104e9dc15635bed3cd2aae8d1fdf05b66c6f9d29c5997d2a16dN.exe

  • Size

    134KB

  • Sample

    241201-ytabdsvncm

  • MD5

    cfce42e278831f3cdca01f86bc500a60

  • SHA1

    b42ff30289417a450eba87faf37198fa733878df

  • SHA256

    0103c8b2dc025104e9dc15635bed3cd2aae8d1fdf05b66c6f9d29c5997d2a16d

  • SHA512

    0880b8f2e7805e68bfa5c9276f8ce9415f2be878d64abad3c62b1552db2ccd61de493726b50e0d1b2098d814969c168cb0bbaf928609a80aeb0f5aa34a31aac0

  • SSDEEP

    1536:kDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:6iRTeH0iqAW6J6f1tqF6dngNmaZCia

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      0103c8b2dc025104e9dc15635bed3cd2aae8d1fdf05b66c6f9d29c5997d2a16dN.exe

    • Size

      134KB

    • MD5

      cfce42e278831f3cdca01f86bc500a60

    • SHA1

      b42ff30289417a450eba87faf37198fa733878df

    • SHA256

      0103c8b2dc025104e9dc15635bed3cd2aae8d1fdf05b66c6f9d29c5997d2a16d

    • SHA512

      0880b8f2e7805e68bfa5c9276f8ce9415f2be878d64abad3c62b1552db2ccd61de493726b50e0d1b2098d814969c168cb0bbaf928609a80aeb0f5aa34a31aac0

    • SSDEEP

      1536:kDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:6iRTeH0iqAW6J6f1tqF6dngNmaZCia

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks