General

  • Target

    647c27729b0c7c233098badffddc9e0fcf375d4ae9130800107613d1f3672917.exe

  • Size

    96KB

  • Sample

    250125-sqb3xsznbp

  • MD5

    cb89fabf46dead53d02318d1f5ff7060

  • SHA1

    f54c253780c05f55b093391bf5ae8f7c977ecaa8

  • SHA256

    647c27729b0c7c233098badffddc9e0fcf375d4ae9130800107613d1f3672917

  • SHA512

    c8bab8add53a24ccdae937c1282dd8f1e4a7bdef5477f1b01adcd2e72add5ef5b03f04675e53a0a0ecbfb371a521ae012bf94bd9eb2152c41049b4adec507bc6

  • SSDEEP

    1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:fGs8cd8eXlYairZYqMddH13B

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      647c27729b0c7c233098badffddc9e0fcf375d4ae9130800107613d1f3672917.exe

    • Size

      96KB

    • MD5

      cb89fabf46dead53d02318d1f5ff7060

    • SHA1

      f54c253780c05f55b093391bf5ae8f7c977ecaa8

    • SHA256

      647c27729b0c7c233098badffddc9e0fcf375d4ae9130800107613d1f3672917

    • SHA512

      c8bab8add53a24ccdae937c1282dd8f1e4a7bdef5477f1b01adcd2e72add5ef5b03f04675e53a0a0ecbfb371a521ae012bf94bd9eb2152c41049b4adec507bc6

    • SSDEEP

      1536:fnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxB:fGs8cd8eXlYairZYqMddH13B

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks