General

  • Target

    c82485549b0da04a1f6001b982166dee43b265038b56bb02f6cbd7a5972359f1N.exe

  • Size

    96KB

  • Sample

    241210-g21pwa1mdn

  • MD5

    88a830fdf0f96f8643fc290710c0a580

  • SHA1

    68fa6d58b5f014a8061456736413a7cc933805b4

  • SHA256

    c82485549b0da04a1f6001b982166dee43b265038b56bb02f6cbd7a5972359f1

  • SHA512

    7b756edc66fcdf047b49744b3d02bbc988d30c570fa075cbac0be04a157947e5d8c4f6aa6f6b8a08d4daa39a4b5f33b81f9e05adc00bfbd73451ceb53ec33e2c

  • SSDEEP

    1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:JGs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      c82485549b0da04a1f6001b982166dee43b265038b56bb02f6cbd7a5972359f1N.exe

    • Size

      96KB

    • MD5

      88a830fdf0f96f8643fc290710c0a580

    • SHA1

      68fa6d58b5f014a8061456736413a7cc933805b4

    • SHA256

      c82485549b0da04a1f6001b982166dee43b265038b56bb02f6cbd7a5972359f1

    • SHA512

      7b756edc66fcdf047b49744b3d02bbc988d30c570fa075cbac0be04a157947e5d8c4f6aa6f6b8a08d4daa39a4b5f33b81f9e05adc00bfbd73451ceb53ec33e2c

    • SSDEEP

      1536:JnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:JGs8cd8eXlYairZYqMddH13z

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks