General

  • Target

    JaffaCakes118_76ad31e7dce644b164e65c0c7df81ca0

  • Size

    128KB

  • Sample

    250104-a7vbqavlek

  • MD5

    76ad31e7dce644b164e65c0c7df81ca0

  • SHA1

    c7b06b97713a22f6206cd3361f54559c6b0470a7

  • SHA256

    4ff84a7908469411f80cba8703cde97010761dba00a818a6b8add28115945cf8

  • SHA512

    e8048b5b820ce897d8fbab00fdd86d51c661aa23e86928912ce69d730fb5a83b2476dd6a3c34e9f252ec3bab0d3a4b3471bc8409a5076e82694fcf26e5c82cc7

  • SSDEEP

    1536:8DfDbhERTatPLTLLbC+8BMNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabau:iiRTe3n8BMAW6J6f1tqF6dngNmaZrN

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      JaffaCakes118_76ad31e7dce644b164e65c0c7df81ca0

    • Size

      128KB

    • MD5

      76ad31e7dce644b164e65c0c7df81ca0

    • SHA1

      c7b06b97713a22f6206cd3361f54559c6b0470a7

    • SHA256

      4ff84a7908469411f80cba8703cde97010761dba00a818a6b8add28115945cf8

    • SHA512

      e8048b5b820ce897d8fbab00fdd86d51c661aa23e86928912ce69d730fb5a83b2476dd6a3c34e9f252ec3bab0d3a4b3471bc8409a5076e82694fcf26e5c82cc7

    • SSDEEP

      1536:8DfDbhERTatPLTLLbC+8BMNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabau:iiRTe3n8BMAW6J6f1tqF6dngNmaZrN

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks