General

  • Target

    1f1293bd222c0a16c43cf639f58a2a3fff4a485f0da6b3aad75d8b856427ff9dN.exe

  • Size

    134KB

  • Sample

    250119-znevcsvqdw

  • MD5

    ef7dc6be4eb3b062cea32a16250b4330

  • SHA1

    42e0d5032f4df88c0b386d53b0899ddaec3e93d9

  • SHA256

    1f1293bd222c0a16c43cf639f58a2a3fff4a485f0da6b3aad75d8b856427ff9d

  • SHA512

    b3df8f230dc6cb74e49445990980f42d2ec0c4f49b5c4786f82e54d0be15939f23993ed2d15d4e8a049f296d5fbfa02825a32271d3e4cd829a6b2af669630cd3

  • SSDEEP

    1536:8DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:iiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      1f1293bd222c0a16c43cf639f58a2a3fff4a485f0da6b3aad75d8b856427ff9dN.exe

    • Size

      134KB

    • MD5

      ef7dc6be4eb3b062cea32a16250b4330

    • SHA1

      42e0d5032f4df88c0b386d53b0899ddaec3e93d9

    • SHA256

      1f1293bd222c0a16c43cf639f58a2a3fff4a485f0da6b3aad75d8b856427ff9d

    • SHA512

      b3df8f230dc6cb74e49445990980f42d2ec0c4f49b5c4786f82e54d0be15939f23993ed2d15d4e8a049f296d5fbfa02825a32271d3e4cd829a6b2af669630cd3

    • SSDEEP

      1536:8DfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:iiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks