General

  • Target

    80d9454386ae597cebff0a0007cba53f5b349947e8cdbb28cc39757a8c8a25e4N.exe

  • Size

    96KB

  • Sample

    241217-1p1znazqck

  • MD5

    eda6f51861aa16c7b9618049096f7a10

  • SHA1

    57cdb9c23c940e2c381f72ba5dd11b8d30b7ccd9

  • SHA256

    80d9454386ae597cebff0a0007cba53f5b349947e8cdbb28cc39757a8c8a25e4

  • SHA512

    cd03f1ae3602caeebdd635f8f48b810aeec5d9a4c1f87bf6d1d12d8209072a8bde1a355540ab36f4676895d8d615dc02c549ccffff92363f62d03687735a3947

  • SSDEEP

    1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      80d9454386ae597cebff0a0007cba53f5b349947e8cdbb28cc39757a8c8a25e4N.exe

    • Size

      96KB

    • MD5

      eda6f51861aa16c7b9618049096f7a10

    • SHA1

      57cdb9c23c940e2c381f72ba5dd11b8d30b7ccd9

    • SHA256

      80d9454386ae597cebff0a0007cba53f5b349947e8cdbb28cc39757a8c8a25e4

    • SHA512

      cd03f1ae3602caeebdd635f8f48b810aeec5d9a4c1f87bf6d1d12d8209072a8bde1a355540ab36f4676895d8d615dc02c549ccffff92363f62d03687735a3947

    • SSDEEP

      1536:znAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:zGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks