General

  • Target

    15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe

  • Size

    134KB

  • Sample

    241211-qjc1jaylcl

  • MD5

    eb3d3b17e41c40cbae73072b9d9a1a7d

  • SHA1

    7c0feef921da8f9d08a476d64afcd55a4bf02726

  • SHA256

    15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d

  • SHA512

    0820ee2bfb04115354be88347bb000ab4d97d65551a64d04f62740d841e663506cb40f4e6eeb1b76ad1650c64d2f1a7d63fc8618083fcdccd725fe4096e293b7

  • SSDEEP

    1536:8DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi1:iiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d.exe

    • Size

      134KB

    • MD5

      eb3d3b17e41c40cbae73072b9d9a1a7d

    • SHA1

      7c0feef921da8f9d08a476d64afcd55a4bf02726

    • SHA256

      15853f870ad80941247d0564dcb5f9f60329ac4905583f16b1541e8d74550f7d

    • SHA512

      0820ee2bfb04115354be88347bb000ab4d97d65551a64d04f62740d841e663506cb40f4e6eeb1b76ad1650c64d2f1a7d63fc8618083fcdccd725fe4096e293b7

    • SSDEEP

      1536:8DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi1:iiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks