General

  • Target

    5f21c755308d6f97c3e2c728919674b97e1a8aa1bdc1ac7cbff65f84833cd825N.exe

  • Size

    96KB

  • Sample

    241216-gyxh2sxpbx

  • MD5

    b68f49ecd7ced38a0036962cdefc7370

  • SHA1

    2506566a81706d4432705bb7ea662bb4bc5b66cb

  • SHA256

    5f21c755308d6f97c3e2c728919674b97e1a8aa1bdc1ac7cbff65f84833cd825

  • SHA512

    5a712b5a0b1782a95ef26d206872a3f27f5f1fea9f1939284e834fcceb55175d32350059d630d59ca19ce8e9164419a9930c60f5b9b02c58ae753ee216398ba7

  • SSDEEP

    1536:snAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:sGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      5f21c755308d6f97c3e2c728919674b97e1a8aa1bdc1ac7cbff65f84833cd825N.exe

    • Size

      96KB

    • MD5

      b68f49ecd7ced38a0036962cdefc7370

    • SHA1

      2506566a81706d4432705bb7ea662bb4bc5b66cb

    • SHA256

      5f21c755308d6f97c3e2c728919674b97e1a8aa1bdc1ac7cbff65f84833cd825

    • SHA512

      5a712b5a0b1782a95ef26d206872a3f27f5f1fea9f1939284e834fcceb55175d32350059d630d59ca19ce8e9164419a9930c60f5b9b02c58ae753ee216398ba7

    • SSDEEP

      1536:snAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:sGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks