General

  • Target

    83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe

  • Size

    96KB

  • Sample

    250119-yygahatmey

  • MD5

    b41e920849e803b332e981b27ac59a30

  • SHA1

    8d0e8f860f347f11823b0513a615992105ee6d07

  • SHA256

    83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5cc

  • SHA512

    b7a3184019d179cc42e88a22b5435470cc67adb279e37a4e34273dec2a67ed93b8928f7e1903ab02bec2a65f1c1c3926417d7c14a64da8849940b53065738ae8

  • SSDEEP

    1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5ccN.exe

    • Size

      96KB

    • MD5

      b41e920849e803b332e981b27ac59a30

    • SHA1

      8d0e8f860f347f11823b0513a615992105ee6d07

    • SHA256

      83a5897567e48881a2d1ff5da18b29092746f659802f0f5ba96760a2e6efc5cc

    • SHA512

      b7a3184019d179cc42e88a22b5435470cc67adb279e37a4e34273dec2a67ed93b8928f7e1903ab02bec2a65f1c1c3926417d7c14a64da8849940b53065738ae8

    • SSDEEP

      1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks