General

  • Target

    71f041c2226479cd85399a52ad3b825cc49b0e408f7a6c25f8322aca1474f780N.exe

  • Size

    96KB

  • Sample

    250125-a1azhawrbv

  • MD5

    62bb14a05c1ce9ce8dec97f5a134ad30

  • SHA1

    1d5ac62685976da5a272a1aee97b47b56b7fef1e

  • SHA256

    71f041c2226479cd85399a52ad3b825cc49b0e408f7a6c25f8322aca1474f780

  • SHA512

    a538e6ac4da02ea15dba077411a6f7a0a047d992453518eac50e4f7d06c191fe31270adafc66cb9ec01cce35a9989b1b6fbf8e207ec41956ddb191386ed2cff1

  • SSDEEP

    1536:DnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:DGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      71f041c2226479cd85399a52ad3b825cc49b0e408f7a6c25f8322aca1474f780N.exe

    • Size

      96KB

    • MD5

      62bb14a05c1ce9ce8dec97f5a134ad30

    • SHA1

      1d5ac62685976da5a272a1aee97b47b56b7fef1e

    • SHA256

      71f041c2226479cd85399a52ad3b825cc49b0e408f7a6c25f8322aca1474f780

    • SHA512

      a538e6ac4da02ea15dba077411a6f7a0a047d992453518eac50e4f7d06c191fe31270adafc66cb9ec01cce35a9989b1b6fbf8e207ec41956ddb191386ed2cff1

    • SSDEEP

      1536:DnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:DGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks