General

  • Target

    bbced7c800c29a8a471f716ec5a88661897beb816622eeb3489fcdf652ddd033

  • Size

    96KB

  • Sample

    250104-fbm6essmcz

  • MD5

    786f4f06717e6df31c71a641de88f62d

  • SHA1

    317c99ccac218aa62c89f9f5a48eeafee32f7d6c

  • SHA256

    bbced7c800c29a8a471f716ec5a88661897beb816622eeb3489fcdf652ddd033

  • SHA512

    371b9eed488019d8b27c6769036055463f2990c49d9db23528fbc2fd74ca09dd1968a1147ee8faa1fc28078817dcde9db92abf705fd73ea11baa497d862e52b1

  • SSDEEP

    1536:nnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:nGs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      bbced7c800c29a8a471f716ec5a88661897beb816622eeb3489fcdf652ddd033

    • Size

      96KB

    • MD5

      786f4f06717e6df31c71a641de88f62d

    • SHA1

      317c99ccac218aa62c89f9f5a48eeafee32f7d6c

    • SHA256

      bbced7c800c29a8a471f716ec5a88661897beb816622eeb3489fcdf652ddd033

    • SHA512

      371b9eed488019d8b27c6769036055463f2990c49d9db23528fbc2fd74ca09dd1968a1147ee8faa1fc28078817dcde9db92abf705fd73ea11baa497d862e52b1

    • SSDEEP

      1536:nnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:nGs8cd8eXlYairZYqMddH13z

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks