General

  • Target

    a2bc6ac66730d6ab6455170b5b49cfa8507f4283ae6da611b8f75910c11310d6

  • Size

    96KB

  • Sample

    250117-f3mzqstrdn

  • MD5

    543e807cf6b3c90d883cb53a56978b4e

  • SHA1

    e2db51773c28bb6130f7959cfeedbcb6bfb31457

  • SHA256

    a2bc6ac66730d6ab6455170b5b49cfa8507f4283ae6da611b8f75910c11310d6

  • SHA512

    d50e1c7aee2a76de5feaa1e3e0914e63fce05a9c4bc1b48375d9fd92c692cebd7549f8ce8c8f96be8ddcc6dd0c8036f99e791d2c876e85740481da7de2136b9c

  • SSDEEP

    1536:ynAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:yGs8cd8eXlYairZYqMddH13x

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      a2bc6ac66730d6ab6455170b5b49cfa8507f4283ae6da611b8f75910c11310d6

    • Size

      96KB

    • MD5

      543e807cf6b3c90d883cb53a56978b4e

    • SHA1

      e2db51773c28bb6130f7959cfeedbcb6bfb31457

    • SHA256

      a2bc6ac66730d6ab6455170b5b49cfa8507f4283ae6da611b8f75910c11310d6

    • SHA512

      d50e1c7aee2a76de5feaa1e3e0914e63fce05a9c4bc1b48375d9fd92c692cebd7549f8ce8c8f96be8ddcc6dd0c8036f99e791d2c876e85740481da7de2136b9c

    • SSDEEP

      1536:ynAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:yGs8cd8eXlYairZYqMddH13x

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks