General

  • Target

    abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe

  • Size

    96KB

  • Sample

    250125-kczytsvkav

  • MD5

    2409224fd7c3512819080b24bf97bd5e

  • SHA1

    25d8ce08c39809a4e7dd40dba10d3ea3cdfb8f3e

  • SHA256

    abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff

  • SHA512

    c0c1abdb61ec763f3782ae30d0e3bac3904b007a62ace994453d5c964663276f8b6389d941b22ee9ba569bd36179beda2258804c004f8e06de2ec358d254b4fd

  • SSDEEP

    1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:NGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff.exe

    • Size

      96KB

    • MD5

      2409224fd7c3512819080b24bf97bd5e

    • SHA1

      25d8ce08c39809a4e7dd40dba10d3ea3cdfb8f3e

    • SHA256

      abd379f18039d12aa5c50b5c101d8472a4d5f5b9e743944cd39ee88c1a40c1ff

    • SHA512

      c0c1abdb61ec763f3782ae30d0e3bac3904b007a62ace994453d5c964663276f8b6389d941b22ee9ba569bd36179beda2258804c004f8e06de2ec358d254b4fd

    • SSDEEP

      1536:NnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:NGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks