General

  • Target

    40a4b0aa4c555c3e71800aba99d22e7d4ae98af226973f398b41f18c4cdf049f.exe

  • Size

    96KB

  • Sample

    241204-gf1sravjay

  • MD5

    88de9c6897937c35255ac10b6bac4a66

  • SHA1

    ad5b907ac354bbbae4bd1ea9b880a1e90470e172

  • SHA256

    40a4b0aa4c555c3e71800aba99d22e7d4ae98af226973f398b41f18c4cdf049f

  • SHA512

    ccb8b91c545641b5da431fad701e3923fd6a4f85b569cbe26f6aefa3a2ebfcf3d90dc0ddaa2a8a5cc0eb4cbfcb47104b3b6150b27dbef418eee405a7619c9bc6

  • SSDEEP

    1536:hnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:hGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      40a4b0aa4c555c3e71800aba99d22e7d4ae98af226973f398b41f18c4cdf049f.exe

    • Size

      96KB

    • MD5

      88de9c6897937c35255ac10b6bac4a66

    • SHA1

      ad5b907ac354bbbae4bd1ea9b880a1e90470e172

    • SHA256

      40a4b0aa4c555c3e71800aba99d22e7d4ae98af226973f398b41f18c4cdf049f

    • SHA512

      ccb8b91c545641b5da431fad701e3923fd6a4f85b569cbe26f6aefa3a2ebfcf3d90dc0ddaa2a8a5cc0eb4cbfcb47104b3b6150b27dbef418eee405a7619c9bc6

    • SSDEEP

      1536:hnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:hGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks