General

  • Target

    b25955d9fa51e1b1b24d673aeb38c815cf5aa570e6043f02160b81c34b2139f2N.exe

  • Size

    96KB

  • Sample

    250122-cxbsqstnhp

  • MD5

    4b183de46047ecc330a2936819f7f180

  • SHA1

    582a75c867d8cb8ee5ba192594fb4b4de46026ee

  • SHA256

    b25955d9fa51e1b1b24d673aeb38c815cf5aa570e6043f02160b81c34b2139f2

  • SHA512

    d1be505c7b596d10496de7f391b2cf14704cb433332fa4569c9ef14944d83f93325a1a9828c0f5352a44dc239d119d0f931902f1146b48c8307449bd0a7f6bdc

  • SSDEEP

    1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:SGs8cd8eXlYairZYqMddH13r

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      b25955d9fa51e1b1b24d673aeb38c815cf5aa570e6043f02160b81c34b2139f2N.exe

    • Size

      96KB

    • MD5

      4b183de46047ecc330a2936819f7f180

    • SHA1

      582a75c867d8cb8ee5ba192594fb4b4de46026ee

    • SHA256

      b25955d9fa51e1b1b24d673aeb38c815cf5aa570e6043f02160b81c34b2139f2

    • SHA512

      d1be505c7b596d10496de7f391b2cf14704cb433332fa4569c9ef14944d83f93325a1a9828c0f5352a44dc239d119d0f931902f1146b48c8307449bd0a7f6bdc

    • SSDEEP

      1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxr:SGs8cd8eXlYairZYqMddH13r

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks