General

  • Target

    b1eb0786518247adf3e6e612ea69e7677036d4004b61496680626e058e495a2d

  • Size

    134KB

  • Sample

    241217-cjhzwsxjfw

  • MD5

    b94b47d7d5e2f2ebfe6016e80093b3ca

  • SHA1

    a6710d18bc197b67b0f43e9f1781ac52ff263466

  • SHA256

    b1eb0786518247adf3e6e612ea69e7677036d4004b61496680626e058e495a2d

  • SHA512

    3e13700b76190934efacde18628621d6438bcb249b54c214fd14606785357018e8a12a57438602357034b4bb59d4b992184e9306238ce805382ced26ae990efc

  • SSDEEP

    1536:qDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:MiRTeH0iqAW6J6f1tqF6dngNmaZCia

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      b1eb0786518247adf3e6e612ea69e7677036d4004b61496680626e058e495a2d

    • Size

      134KB

    • MD5

      b94b47d7d5e2f2ebfe6016e80093b3ca

    • SHA1

      a6710d18bc197b67b0f43e9f1781ac52ff263466

    • SHA256

      b1eb0786518247adf3e6e612ea69e7677036d4004b61496680626e058e495a2d

    • SHA512

      3e13700b76190934efacde18628621d6438bcb249b54c214fd14606785357018e8a12a57438602357034b4bb59d4b992184e9306238ce805382ced26ae990efc

    • SSDEEP

      1536:qDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:MiRTeH0iqAW6J6f1tqF6dngNmaZCia

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks