General

  • Target

    ef32316ad792dee5bda8e1cf66828ace6b03acb32b13ce9c393a0821082507b4N.exe

  • Size

    96KB

  • Sample

    250201-p413esvmhm

  • MD5

    28bddfa5d0097af654ebbc6202aac5d0

  • SHA1

    7fb0227abbb80c4dd8cfda65eb637b46cbbbc342

  • SHA256

    ef32316ad792dee5bda8e1cf66828ace6b03acb32b13ce9c393a0821082507b4

  • SHA512

    8b4298e7b5e81cc1dc2c08548cb3d8edebe4ae58ad84a08fe45368d0c07b8a8a60fb23a2b70b3165611f5e5a149050d03e07bd9b900a587be7552771a1ec0121

  • SSDEEP

    1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:KGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      ef32316ad792dee5bda8e1cf66828ace6b03acb32b13ce9c393a0821082507b4N.exe

    • Size

      96KB

    • MD5

      28bddfa5d0097af654ebbc6202aac5d0

    • SHA1

      7fb0227abbb80c4dd8cfda65eb637b46cbbbc342

    • SHA256

      ef32316ad792dee5bda8e1cf66828ace6b03acb32b13ce9c393a0821082507b4

    • SHA512

      8b4298e7b5e81cc1dc2c08548cb3d8edebe4ae58ad84a08fe45368d0c07b8a8a60fb23a2b70b3165611f5e5a149050d03e07bd9b900a587be7552771a1ec0121

    • SSDEEP

      1536:KnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:KGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks