General

  • Target

    739b78ad0a55b39f776d3f584306fc12de6b7ed187f59c4213dba46fd51b6f42N.exe

  • Size

    96KB

  • Sample

    250119-r49qnsspdm

  • MD5

    080594bcf7871f91672db59210446840

  • SHA1

    f831d47f2d7ea176b6b41e88b5318167ade5b450

  • SHA256

    739b78ad0a55b39f776d3f584306fc12de6b7ed187f59c4213dba46fd51b6f42

  • SHA512

    19ae0b3a739a1f27a2e702c2fb8d23f8a14eeb9eed537e177276b0fdae90eaf118ec319048b6517bddcb448bec988688d50b425ebc4e82402fe1decd89974639

  • SSDEEP

    1536:5nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:5Gs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      739b78ad0a55b39f776d3f584306fc12de6b7ed187f59c4213dba46fd51b6f42N.exe

    • Size

      96KB

    • MD5

      080594bcf7871f91672db59210446840

    • SHA1

      f831d47f2d7ea176b6b41e88b5318167ade5b450

    • SHA256

      739b78ad0a55b39f776d3f584306fc12de6b7ed187f59c4213dba46fd51b6f42

    • SHA512

      19ae0b3a739a1f27a2e702c2fb8d23f8a14eeb9eed537e177276b0fdae90eaf118ec319048b6517bddcb448bec988688d50b425ebc4e82402fe1decd89974639

    • SSDEEP

      1536:5nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:5Gs8cd8eXlYairZYqMddH13z

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks