General

  • Target

    3a76b4b133225ee0fe5eeff15a25f35ce64ed34d03982a8953619d038039093e.exe

  • Size

    96KB

  • Sample

    241205-la1ysaxret

  • MD5

    368d064efacaaa20abc57a01c83e0f3e

  • SHA1

    2f0a36ebc6e185071605afa653ad3da504d4df62

  • SHA256

    3a76b4b133225ee0fe5eeff15a25f35ce64ed34d03982a8953619d038039093e

  • SHA512

    641a4ac039b2cb409b615069c1874a004e0f0da2e4a69937bd176a089c12b1960597afb12bb10b0f218ecc126cf85ad53a5ae4f099844ab316e3d43c20f172c9

  • SSDEEP

    1536:+nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxh:+Gs8cd8eXlYairZYqMddH13h

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      3a76b4b133225ee0fe5eeff15a25f35ce64ed34d03982a8953619d038039093e.exe

    • Size

      96KB

    • MD5

      368d064efacaaa20abc57a01c83e0f3e

    • SHA1

      2f0a36ebc6e185071605afa653ad3da504d4df62

    • SHA256

      3a76b4b133225ee0fe5eeff15a25f35ce64ed34d03982a8953619d038039093e

    • SHA512

      641a4ac039b2cb409b615069c1874a004e0f0da2e4a69937bd176a089c12b1960597afb12bb10b0f218ecc126cf85ad53a5ae4f099844ab316e3d43c20f172c9

    • SSDEEP

      1536:+nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxh:+Gs8cd8eXlYairZYqMddH13h

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks