General

  • Target

    4aaca5ed0bd7cdc33f1295f68bf14c9a937514c01d9c1bd65e1a80a411ec8c47.exe

  • Size

    96KB

  • Sample

    250127-k5gb7a1mhz

  • MD5

    c76ae9d599a9785e771abf4f29ceecfb

  • SHA1

    5081943f7567b15af6bd451e27ce37b46b2b3908

  • SHA256

    4aaca5ed0bd7cdc33f1295f68bf14c9a937514c01d9c1bd65e1a80a411ec8c47

  • SHA512

    0e747cf070e24c6d8a509079f7dd33c3ec9175a6c3df13e038a30a7b90daf56c3b40497b1f0ec0970818ba56d76bf9df65c5ce86f0eeb71eb6514b1b41c31ad7

  • SSDEEP

    1536:jnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:jGs8cd8eXlYairZYqMddH13x

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      4aaca5ed0bd7cdc33f1295f68bf14c9a937514c01d9c1bd65e1a80a411ec8c47.exe

    • Size

      96KB

    • MD5

      c76ae9d599a9785e771abf4f29ceecfb

    • SHA1

      5081943f7567b15af6bd451e27ce37b46b2b3908

    • SHA256

      4aaca5ed0bd7cdc33f1295f68bf14c9a937514c01d9c1bd65e1a80a411ec8c47

    • SHA512

      0e747cf070e24c6d8a509079f7dd33c3ec9175a6c3df13e038a30a7b90daf56c3b40497b1f0ec0970818ba56d76bf9df65c5ce86f0eeb71eb6514b1b41c31ad7

    • SSDEEP

      1536:jnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxx:jGs8cd8eXlYairZYqMddH13x

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks