General

  • Target

    fa85e93d6bb10cd45da3d23881b838218ec90368e0c164f8f99ac0d5bdf64c04N.exe

  • Size

    96KB

  • Sample

    241202-sd8lcsyncs

  • MD5

    f0d13b0277df2e4993d830536d860510

  • SHA1

    9341e18dcfe93ac48971fc0967383a919a036e63

  • SHA256

    fa85e93d6bb10cd45da3d23881b838218ec90368e0c164f8f99ac0d5bdf64c04

  • SHA512

    94f134046f8761f808b30784f4e4496338812104ed1a0313746116b4b39e644cc7dd33df6d1d40e6f7c009f016a311ba118dac46e081d864f0d7f26df5eb2074

  • SSDEEP

    1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:JGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      fa85e93d6bb10cd45da3d23881b838218ec90368e0c164f8f99ac0d5bdf64c04N.exe

    • Size

      96KB

    • MD5

      f0d13b0277df2e4993d830536d860510

    • SHA1

      9341e18dcfe93ac48971fc0967383a919a036e63

    • SHA256

      fa85e93d6bb10cd45da3d23881b838218ec90368e0c164f8f99ac0d5bdf64c04

    • SHA512

      94f134046f8761f808b30784f4e4496338812104ed1a0313746116b4b39e644cc7dd33df6d1d40e6f7c009f016a311ba118dac46e081d864f0d7f26df5eb2074

    • SSDEEP

      1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:JGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks