General

  • Target

    89e80795c52ddf6c44ed982257da893c4edb18f2b71e46ec9d0564c09f787dd0.exe

  • Size

    134KB

  • Sample

    241226-nekhpstqcx

  • MD5

    3d5b3c7cb20af8977f78ccfefb8cc367

  • SHA1

    d0e1ad339d0e8741bb966323522734498e5f81dd

  • SHA256

    89e80795c52ddf6c44ed982257da893c4edb18f2b71e46ec9d0564c09f787dd0

  • SHA512

    c695929ab9ab7fa93ea43d476b5b55bbe586b1b9a559dcfeee641b4f1016f6573d5def299a96eac55815f1d42e6d8138701e324244f695663490401fe2a822ae

  • SSDEEP

    1536:KDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiV:siRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      89e80795c52ddf6c44ed982257da893c4edb18f2b71e46ec9d0564c09f787dd0.exe

    • Size

      134KB

    • MD5

      3d5b3c7cb20af8977f78ccfefb8cc367

    • SHA1

      d0e1ad339d0e8741bb966323522734498e5f81dd

    • SHA256

      89e80795c52ddf6c44ed982257da893c4edb18f2b71e46ec9d0564c09f787dd0

    • SHA512

      c695929ab9ab7fa93ea43d476b5b55bbe586b1b9a559dcfeee641b4f1016f6573d5def299a96eac55815f1d42e6d8138701e324244f695663490401fe2a822ae

    • SSDEEP

      1536:KDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiV:siRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks