General

  • Target

    95c7ba45a94a98713c24bd664cfb4c5e4f6c3daf681530799f1372161ada488cN.exe

  • Size

    134KB

  • Sample

    250127-d596yaymc1

  • MD5

    40e2396dc161bed1a4864ebe78e50320

  • SHA1

    242b7e4f41850080d11d81902cbbea32cf078414

  • SHA256

    95c7ba45a94a98713c24bd664cfb4c5e4f6c3daf681530799f1372161ada488c

  • SHA512

    71188890e9856eac2275421c6d795eb40fbc321b511ad27c5c1ae51ce5aea54963d03c315dc9fa2203b4cf41975e7a133e867a5f2e3dc796340b5b6fd00c1008

  • SSDEEP

    1536:aDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:8iRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      95c7ba45a94a98713c24bd664cfb4c5e4f6c3daf681530799f1372161ada488cN.exe

    • Size

      134KB

    • MD5

      40e2396dc161bed1a4864ebe78e50320

    • SHA1

      242b7e4f41850080d11d81902cbbea32cf078414

    • SHA256

      95c7ba45a94a98713c24bd664cfb4c5e4f6c3daf681530799f1372161ada488c

    • SHA512

      71188890e9856eac2275421c6d795eb40fbc321b511ad27c5c1ae51ce5aea54963d03c315dc9fa2203b4cf41975e7a133e867a5f2e3dc796340b5b6fd00c1008

    • SSDEEP

      1536:aDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:8iRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks