General

  • Target

    ae6674adfc39acc7ad8dfca53adb2b2e344f8a3f2a65b2fb989f503d85f5e34c.exe

  • Size

    96KB

  • Sample

    241202-x4994aylhv

  • MD5

    8d3451b5deaebdda6578fba417dca760

  • SHA1

    fe22f844f47eac7cd984de8718d19b751cd85d0b

  • SHA256

    ae6674adfc39acc7ad8dfca53adb2b2e344f8a3f2a65b2fb989f503d85f5e34c

  • SHA512

    7105663d1fe0c95bb73e547a3abd93158627b34982aabd0dbb18b8885c4023b9ac70bd58f282e26c4d03bbab8e2e90e0d5d2f01720360ff92a2e6b03d8b57b64

  • SSDEEP

    1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:WGs8cd8eXlYairZYqMddH13x

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      ae6674adfc39acc7ad8dfca53adb2b2e344f8a3f2a65b2fb989f503d85f5e34c.exe

    • Size

      96KB

    • MD5

      8d3451b5deaebdda6578fba417dca760

    • SHA1

      fe22f844f47eac7cd984de8718d19b751cd85d0b

    • SHA256

      ae6674adfc39acc7ad8dfca53adb2b2e344f8a3f2a65b2fb989f503d85f5e34c

    • SHA512

      7105663d1fe0c95bb73e547a3abd93158627b34982aabd0dbb18b8885c4023b9ac70bd58f282e26c4d03bbab8e2e90e0d5d2f01720360ff92a2e6b03d8b57b64

    • SSDEEP

      1536:WnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:WGs8cd8eXlYairZYqMddH13x

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks