General

  • Target

    c1ccec61ba6fcfb152db09a0ed86a9d33e7b0e290427b99375f4d1307b909cd5.exe

  • Size

    96KB

  • Sample

    250119-1alanaxlaq

  • MD5

    eca5251ebf7783c89f267764cd2348e7

  • SHA1

    be5f03c1242410f989a716e65a131178d7836d6f

  • SHA256

    c1ccec61ba6fcfb152db09a0ed86a9d33e7b0e290427b99375f4d1307b909cd5

  • SHA512

    411c9a41982fafd99dfb882da6ef3f064b7a14235b7376372b55a6ee670984a778a5fdddd8b47a6e1e1cea0e55d76c9431f39af7e4f7ee4be10da5d2c4d9cdf8

  • SSDEEP

    1536:vnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:vGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      c1ccec61ba6fcfb152db09a0ed86a9d33e7b0e290427b99375f4d1307b909cd5.exe

    • Size

      96KB

    • MD5

      eca5251ebf7783c89f267764cd2348e7

    • SHA1

      be5f03c1242410f989a716e65a131178d7836d6f

    • SHA256

      c1ccec61ba6fcfb152db09a0ed86a9d33e7b0e290427b99375f4d1307b909cd5

    • SHA512

      411c9a41982fafd99dfb882da6ef3f064b7a14235b7376372b55a6ee670984a778a5fdddd8b47a6e1e1cea0e55d76c9431f39af7e4f7ee4be10da5d2c4d9cdf8

    • SSDEEP

      1536:vnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:vGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks