General

  • Target

    cdb901c7462da55aa2bde2ecc1b2f416c9b99a8702957e52d197fd9fcd22f3dc

  • Size

    96KB

  • Sample

    250124-kgrg9a1kcr

  • MD5

    855d8b68a2b217f91ad08aa09042fb66

  • SHA1

    41a47e4d760a72d82cd8796b905d6a51a19473f4

  • SHA256

    cdb901c7462da55aa2bde2ecc1b2f416c9b99a8702957e52d197fd9fcd22f3dc

  • SHA512

    769515bab20beb3b98b11bc054caad6094570ee5607ac80e648d713f9a2a15b59830f298e84abf2ee4cfd605cfcc21665af4137eabb8e8945bbfb159b7c89452

  • SSDEEP

    1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:KGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      cdb901c7462da55aa2bde2ecc1b2f416c9b99a8702957e52d197fd9fcd22f3dc

    • Size

      96KB

    • MD5

      855d8b68a2b217f91ad08aa09042fb66

    • SHA1

      41a47e4d760a72d82cd8796b905d6a51a19473f4

    • SHA256

      cdb901c7462da55aa2bde2ecc1b2f416c9b99a8702957e52d197fd9fcd22f3dc

    • SHA512

      769515bab20beb3b98b11bc054caad6094570ee5607ac80e648d713f9a2a15b59830f298e84abf2ee4cfd605cfcc21665af4137eabb8e8945bbfb159b7c89452

    • SSDEEP

      1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:KGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks