General

  • Target

    a4eb1196040e7f78b601645c9906246f1b688566b61cb11fcf3882215d5b4380.exe

  • Size

    134KB

  • Sample

    250113-v7qczstkcl

  • MD5

    0a197348ada0a4dbe7930fa2d7661220

  • SHA1

    a5422ec34634bffcd6c46770c73015b2fda886dc

  • SHA256

    a4eb1196040e7f78b601645c9906246f1b688566b61cb11fcf3882215d5b4380

  • SHA512

    90fe6f284f79058ffa792217562c2062f5d17dc0fe1543dbfb02c604519e0fa6c9ee0783bdb2b6edf3a21d0aa39ad106a49f8e807a396c9d630b7bc29fc83cb3

  • SSDEEP

    1536:GDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:4iRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      a4eb1196040e7f78b601645c9906246f1b688566b61cb11fcf3882215d5b4380.exe

    • Size

      134KB

    • MD5

      0a197348ada0a4dbe7930fa2d7661220

    • SHA1

      a5422ec34634bffcd6c46770c73015b2fda886dc

    • SHA256

      a4eb1196040e7f78b601645c9906246f1b688566b61cb11fcf3882215d5b4380

    • SHA512

      90fe6f284f79058ffa792217562c2062f5d17dc0fe1543dbfb02c604519e0fa6c9ee0783bdb2b6edf3a21d0aa39ad106a49f8e807a396c9d630b7bc29fc83cb3

    • SSDEEP

      1536:GDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:4iRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks