General

  • Target

    0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833

  • Size

    96KB

  • Sample

    250114-yew7lsxlf1

  • MD5

    702d7d818e2b3e5661a7c61433a20118

  • SHA1

    1ffe06c9db1e8178806bfe02e971b17b261f7abc

  • SHA256

    0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833

  • SHA512

    7fa4b86a390a0a658f5f95edce7d731375cb36bdb9dde4bb4230441e83c51260c59c84b6c6291de8a0e6026c5f65c356244205943ef588cb2067550b79da8124

  • SSDEEP

    1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:HGs8cd8eXlYairZYqMddH13r

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833

    • Size

      96KB

    • MD5

      702d7d818e2b3e5661a7c61433a20118

    • SHA1

      1ffe06c9db1e8178806bfe02e971b17b261f7abc

    • SHA256

      0ca25d6b6c2bef3fe5b64d4d8f0133e53a0f02c9316bcb05ad1612fa6bbbe833

    • SHA512

      7fa4b86a390a0a658f5f95edce7d731375cb36bdb9dde4bb4230441e83c51260c59c84b6c6291de8a0e6026c5f65c356244205943ef588cb2067550b79da8124

    • SSDEEP

      1536:HnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:HGs8cd8eXlYairZYqMddH13r

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks