General

  • Target

    6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe

  • Size

    96KB

  • Sample

    250122-qky96aypfm

  • MD5

    e108e8f374797fefd9917f5563343b00

  • SHA1

    306763d0a77657d638e093d4ac809187f709cf27

  • SHA256

    6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1

  • SHA512

    1cca39848bd09ef84a534d98a8a725272ae23ad054978b4d96c63cc12d30339119b97c9b8a79709fe00ff6797adc2aea9e8fd878147002f93abe51fede03aaad

  • SSDEEP

    1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:BGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1N.exe

    • Size

      96KB

    • MD5

      e108e8f374797fefd9917f5563343b00

    • SHA1

      306763d0a77657d638e093d4ac809187f709cf27

    • SHA256

      6eb54419c10c7c367117116b93d993bcc795d2c57a93d8515245e55fceaa45d1

    • SHA512

      1cca39848bd09ef84a534d98a8a725272ae23ad054978b4d96c63cc12d30339119b97c9b8a79709fe00ff6797adc2aea9e8fd878147002f93abe51fede03aaad

    • SSDEEP

      1536:BnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:BGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks