General

  • Target

    2f1188d9fd663b3fbc33bda75bca8dacc9f54d1bc70296d7cab00d55391812d5

  • Size

    96KB

  • Sample

    250120-26gssatrcv

  • MD5

    94db6bb5e7fcf3f787783b451cc4e758

  • SHA1

    2cc1a4f04f2a834bfd0d7d5e12e5bf8bfbbec968

  • SHA256

    2f1188d9fd663b3fbc33bda75bca8dacc9f54d1bc70296d7cab00d55391812d5

  • SHA512

    142aafcd976eeb76021766d69fa63210b4afe402feb41a877939d386025537b9397c2192a0c0869c014b20808388894eb95d0648310243893aa8fb3e89d19b79

  • SSDEEP

    1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:UGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      2f1188d9fd663b3fbc33bda75bca8dacc9f54d1bc70296d7cab00d55391812d5

    • Size

      96KB

    • MD5

      94db6bb5e7fcf3f787783b451cc4e758

    • SHA1

      2cc1a4f04f2a834bfd0d7d5e12e5bf8bfbbec968

    • SHA256

      2f1188d9fd663b3fbc33bda75bca8dacc9f54d1bc70296d7cab00d55391812d5

    • SHA512

      142aafcd976eeb76021766d69fa63210b4afe402feb41a877939d386025537b9397c2192a0c0869c014b20808388894eb95d0648310243893aa8fb3e89d19b79

    • SSDEEP

      1536:UnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:UGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks