General

  • Target

    4c41d619b25e431c35686261990c9c8e90952128c9c0f46dc86c123c043fc1fa.exe

  • Size

    96KB

  • Sample

    250119-259r6szrdj

  • MD5

    2d7e939287535612dbb41a733fcfc732

  • SHA1

    bc8ad3ba3f34ff2f083faa7e5cff2c9980b39715

  • SHA256

    4c41d619b25e431c35686261990c9c8e90952128c9c0f46dc86c123c043fc1fa

  • SHA512

    46d9912255c2a67aa75eecbae9c5cf05980ecc69f61c386bb89789b5fe750fcf03f6c646b92fce60aefce4dc09c326c6ebd72809c8b71896099a991182f7912b

  • SSDEEP

    1536:qnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:qGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      4c41d619b25e431c35686261990c9c8e90952128c9c0f46dc86c123c043fc1fa.exe

    • Size

      96KB

    • MD5

      2d7e939287535612dbb41a733fcfc732

    • SHA1

      bc8ad3ba3f34ff2f083faa7e5cff2c9980b39715

    • SHA256

      4c41d619b25e431c35686261990c9c8e90952128c9c0f46dc86c123c043fc1fa

    • SHA512

      46d9912255c2a67aa75eecbae9c5cf05980ecc69f61c386bb89789b5fe750fcf03f6c646b92fce60aefce4dc09c326c6ebd72809c8b71896099a991182f7912b

    • SSDEEP

      1536:qnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:qGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks