General

  • Target

    215e97f35409a7cf090cbb483d87ffc117c55bb7e43ae4ec49daea6c0b6e1df7.exe

  • Size

    96KB

  • Sample

    250116-w8d7satpcm

  • MD5

    44a4e8ddd0b8c71b3f53fd7d5dfb4548

  • SHA1

    bffb2df54ec99b095237c3e85ab92b187c7a3701

  • SHA256

    215e97f35409a7cf090cbb483d87ffc117c55bb7e43ae4ec49daea6c0b6e1df7

  • SHA512

    e6cb2d37fe98c269281a25d6b6c65bddfb84dc06d396370824ed59a6a2a0af05e63c4cb0fa30b09b4e3a9d1b7b359ad70b3ea67cdae15fdf946652a07f489739

  • SSDEEP

    1536:5nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx+:5Gs8cd8eXlYairZYqMddH13+

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      215e97f35409a7cf090cbb483d87ffc117c55bb7e43ae4ec49daea6c0b6e1df7.exe

    • Size

      96KB

    • MD5

      44a4e8ddd0b8c71b3f53fd7d5dfb4548

    • SHA1

      bffb2df54ec99b095237c3e85ab92b187c7a3701

    • SHA256

      215e97f35409a7cf090cbb483d87ffc117c55bb7e43ae4ec49daea6c0b6e1df7

    • SHA512

      e6cb2d37fe98c269281a25d6b6c65bddfb84dc06d396370824ed59a6a2a0af05e63c4cb0fa30b09b4e3a9d1b7b359ad70b3ea67cdae15fdf946652a07f489739

    • SSDEEP

      1536:5nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx+:5Gs8cd8eXlYairZYqMddH13+

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks