General

  • Target

    ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23

  • Size

    96KB

  • Sample

    241211-c1fabs1rf1

  • MD5

    99ca5d0619fad80b91b8db48c0816d89

  • SHA1

    917ea111c1ec1d8974d6833556bfc15e23ca0f68

  • SHA256

    ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23

  • SHA512

    014ade3f395ec2160f62a30d9771e953f661bce89feaa6a6a297771534096e57189ee0956940d07b12887146da8a89f4d336c2f8d2839a7527112199dc556891

  • SSDEEP

    1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:bGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23

    • Size

      96KB

    • MD5

      99ca5d0619fad80b91b8db48c0816d89

    • SHA1

      917ea111c1ec1d8974d6833556bfc15e23ca0f68

    • SHA256

      ab9afb3150852f7bb5830cc0c2edbdaa3d6798e232dfcdac9c69ea1345e57f23

    • SHA512

      014ade3f395ec2160f62a30d9771e953f661bce89feaa6a6a297771534096e57189ee0956940d07b12887146da8a89f4d336c2f8d2839a7527112199dc556891

    • SSDEEP

      1536:bnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:bGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks