General

  • Target

    3787791d3ec869833001c24b9497b20c4942b0297a00c65b4aabb6879a5022aeN.exe

  • Size

    96KB

  • Sample

    250120-m3fnzswje1

  • MD5

    1ed206ccb847192d9a5bc700d2ce9f30

  • SHA1

    8cd8f19f39ba976f4ae5260aa247b534dc78a7f7

  • SHA256

    3787791d3ec869833001c24b9497b20c4942b0297a00c65b4aabb6879a5022ae

  • SHA512

    ff27ddf559984e66e34dec8e88ba876a92b0103921bb0bbe53eabefc015079bf9ba6ed43d595ffcfb6b730a591a5fbc3e1e07e2ed21a01605f2e125e8c67a42a

  • SSDEEP

    1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:4Gs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      3787791d3ec869833001c24b9497b20c4942b0297a00c65b4aabb6879a5022aeN.exe

    • Size

      96KB

    • MD5

      1ed206ccb847192d9a5bc700d2ce9f30

    • SHA1

      8cd8f19f39ba976f4ae5260aa247b534dc78a7f7

    • SHA256

      3787791d3ec869833001c24b9497b20c4942b0297a00c65b4aabb6879a5022ae

    • SHA512

      ff27ddf559984e66e34dec8e88ba876a92b0103921bb0bbe53eabefc015079bf9ba6ed43d595ffcfb6b730a591a5fbc3e1e07e2ed21a01605f2e125e8c67a42a

    • SSDEEP

      1536:4nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:4Gs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks