General

  • Target

    eaac3b63afb4b2ed7b1f2ac1b7474552059ddb471a9cb40661fd14edd1f77543

  • Size

    96KB

  • Sample

    250118-pepcbstpaq

  • MD5

    9077f406c77180e40d5be6e2c416b925

  • SHA1

    4c5d516ee659ef093d3951de4bdf1e277e304aae

  • SHA256

    eaac3b63afb4b2ed7b1f2ac1b7474552059ddb471a9cb40661fd14edd1f77543

  • SHA512

    280c8fd447a7e3ba8ac811246f78f496efa06da24e9b8ec89fa8663fec3ef777452c36b610cf19586d4f9d943a4ba93f45bd0d41f43b8912823b44a7f00e1c06

  • SSDEEP

    1536:onAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:oGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      eaac3b63afb4b2ed7b1f2ac1b7474552059ddb471a9cb40661fd14edd1f77543

    • Size

      96KB

    • MD5

      9077f406c77180e40d5be6e2c416b925

    • SHA1

      4c5d516ee659ef093d3951de4bdf1e277e304aae

    • SHA256

      eaac3b63afb4b2ed7b1f2ac1b7474552059ddb471a9cb40661fd14edd1f77543

    • SHA512

      280c8fd447a7e3ba8ac811246f78f496efa06da24e9b8ec89fa8663fec3ef777452c36b610cf19586d4f9d943a4ba93f45bd0d41f43b8912823b44a7f00e1c06

    • SSDEEP

      1536:onAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:oGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks