General

  • Target

    71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe

  • Size

    96KB

  • Sample

    250122-t2hwaawmcr

  • MD5

    222bfbca7c8bce5d38157745ae9a367e

  • SHA1

    15ad9d1af48d3fa455a79ffa3e85636170404817

  • SHA256

    71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f

  • SHA512

    f7675a4dee7e4f91898e279c5e059e24072c9038eb60901ceee50c393c5597987b939a56a9e4eacce11a398d4fa1c62732cb6391772474b6b47e99815a0bbdea

  • SSDEEP

    1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:SGs8cd8eXlYairZYqMddH137

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f.exe

    • Size

      96KB

    • MD5

      222bfbca7c8bce5d38157745ae9a367e

    • SHA1

      15ad9d1af48d3fa455a79ffa3e85636170404817

    • SHA256

      71ef201ec460d59128225fbe9077d2fa8328c4a70c675ac3128e35a4e323aa0f

    • SHA512

      f7675a4dee7e4f91898e279c5e059e24072c9038eb60901ceee50c393c5597987b939a56a9e4eacce11a398d4fa1c62732cb6391772474b6b47e99815a0bbdea

    • SSDEEP

      1536:SnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxx7:SGs8cd8eXlYairZYqMddH137

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks