General

  • Target

    096fba76be1678c903c6989c1d8005b3accc36d0ab8668f98ed7c5ce161f994f

  • Size

    96KB

  • Sample

    250106-yegf6axper

  • MD5

    c261a75f6c9f7a22d29f7d47424c9f1b

  • SHA1

    0023b2369c66b591b01478264bb22e64cd5bb2be

  • SHA256

    096fba76be1678c903c6989c1d8005b3accc36d0ab8668f98ed7c5ce161f994f

  • SHA512

    9bd15e1b296a26bbbe60472958f0b3b7a8b70dbed81165b99b623d468213888d5bebcd838ed5ccac35feb3e9ecbe8d80a009d98b1fad7c370c02f32f7badfb12

  • SSDEEP

    1536:PnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:PGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      096fba76be1678c903c6989c1d8005b3accc36d0ab8668f98ed7c5ce161f994f

    • Size

      96KB

    • MD5

      c261a75f6c9f7a22d29f7d47424c9f1b

    • SHA1

      0023b2369c66b591b01478264bb22e64cd5bb2be

    • SHA256

      096fba76be1678c903c6989c1d8005b3accc36d0ab8668f98ed7c5ce161f994f

    • SHA512

      9bd15e1b296a26bbbe60472958f0b3b7a8b70dbed81165b99b623d468213888d5bebcd838ed5ccac35feb3e9ecbe8d80a009d98b1fad7c370c02f32f7badfb12

    • SSDEEP

      1536:PnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:PGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks