Behavioral task
behavioral1
Sample
b308483f9fed901628a9341f9ac7e1546f44f1643979e2f70224e7e9612a8429.exe
Resource
win7-20240903-en
General
-
Target
b308483f9fed901628a9341f9ac7e1546f44f1643979e2f70224e7e9612a8429
-
Size
70KB
-
MD5
b483ab5c9018ea96cb70d2b40c4f8d1e
-
SHA1
5d28d055562b55df9e4d4aa9e87c1a8907598d5d
-
SHA256
b308483f9fed901628a9341f9ac7e1546f44f1643979e2f70224e7e9612a8429
-
SHA512
3acd494d5c4264d186ad246fc7e189102b0b7deaaadcbb38556a618d04fe8bd29d1ef0368c97e05c0992a0f83759ca9fe6e7e6ec1f8b380dd1160388acbc1ace
-
SSDEEP
1536:kd9dseIOcE93bIvYvZEyF4EEOF+N4yS+AQmZsDHNzfE:cdseIOMEZEyFjEOFuTiQm+DHNzfE
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b308483f9fed901628a9341f9ac7e1546f44f1643979e2f70224e7e9612a8429
Files
-
b308483f9fed901628a9341f9ac7e1546f44f1643979e2f70224e7e9612a8429.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE