General

  • Target

    2392e1c3406dbe8d715a8e2d84625941c6f887f4106890645935f2f842439a11

  • Size

    134KB

  • Sample

    241227-y4l3yayqex

  • MD5

    3ec3676a6b7abe2484e9c50e4c7ec589

  • SHA1

    4b88f104b7cf08b432aa246a2700db1e71748c8f

  • SHA256

    2392e1c3406dbe8d715a8e2d84625941c6f887f4106890645935f2f842439a11

  • SHA512

    c5a6c1964305d99c2124a576d0b3f915af386a2135a3b8c14c806773506dffaca088ff58c018ac61418975e04129848adad97852660c4a181633e514e3cdb16f

  • SSDEEP

    1536:1DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiF:ViRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      2392e1c3406dbe8d715a8e2d84625941c6f887f4106890645935f2f842439a11

    • Size

      134KB

    • MD5

      3ec3676a6b7abe2484e9c50e4c7ec589

    • SHA1

      4b88f104b7cf08b432aa246a2700db1e71748c8f

    • SHA256

      2392e1c3406dbe8d715a8e2d84625941c6f887f4106890645935f2f842439a11

    • SHA512

      c5a6c1964305d99c2124a576d0b3f915af386a2135a3b8c14c806773506dffaca088ff58c018ac61418975e04129848adad97852660c4a181633e514e3cdb16f

    • SSDEEP

      1536:1DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiF:ViRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks