General

  • Target

    a0a954e78e6b774f13d2a345d76cb2cfacac5168a31c3ee6531494dc72b68c25

  • Size

    96KB

  • Sample

    250115-f7m6asvjbp

  • MD5

    7fbb4678106af6e9f226ef321e30c927

  • SHA1

    afee6cbc414374c9f09e7e310f63ea85319db6d7

  • SHA256

    a0a954e78e6b774f13d2a345d76cb2cfacac5168a31c3ee6531494dc72b68c25

  • SHA512

    fa954db7ff1371e9887cffa0cea5b8123dd675883e85984177b42285107a0e4f514cb58489fdb574f69d774941e2fb1a7a9ac3db728458db94f8724bca66e29f

  • SSDEEP

    1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:tGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      a0a954e78e6b774f13d2a345d76cb2cfacac5168a31c3ee6531494dc72b68c25

    • Size

      96KB

    • MD5

      7fbb4678106af6e9f226ef321e30c927

    • SHA1

      afee6cbc414374c9f09e7e310f63ea85319db6d7

    • SHA256

      a0a954e78e6b774f13d2a345d76cb2cfacac5168a31c3ee6531494dc72b68c25

    • SHA512

      fa954db7ff1371e9887cffa0cea5b8123dd675883e85984177b42285107a0e4f514cb58489fdb574f69d774941e2fb1a7a9ac3db728458db94f8724bca66e29f

    • SSDEEP

      1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:tGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks