General

  • Target

    63ed056e5f854dadae977cbe5b5c963d1415e0e9b6df733a668dd5c62ee6cd91N.exe

  • Size

    96KB

  • Sample

    250202-axlltsxlet

  • MD5

    5dd6db59424962a5e123881c19b46380

  • SHA1

    bba3d5d68e45d81bd7b4a1dad83656fbe7426c25

  • SHA256

    63ed056e5f854dadae977cbe5b5c963d1415e0e9b6df733a668dd5c62ee6cd91

  • SHA512

    f7bd90117ace88aed44538ae98d7a9e1b2837a6a81e3854d355a0cf1146edb619e4806480f76cd5bff438abbd4a997baa34405ea8ec9f65d840bbf50fb7ab862

  • SSDEEP

    1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:tGs8cd8eXlYairZYqMddH13L

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      63ed056e5f854dadae977cbe5b5c963d1415e0e9b6df733a668dd5c62ee6cd91N.exe

    • Size

      96KB

    • MD5

      5dd6db59424962a5e123881c19b46380

    • SHA1

      bba3d5d68e45d81bd7b4a1dad83656fbe7426c25

    • SHA256

      63ed056e5f854dadae977cbe5b5c963d1415e0e9b6df733a668dd5c62ee6cd91

    • SHA512

      f7bd90117ace88aed44538ae98d7a9e1b2837a6a81e3854d355a0cf1146edb619e4806480f76cd5bff438abbd4a997baa34405ea8ec9f65d840bbf50fb7ab862

    • SSDEEP

      1536:tnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:tGs8cd8eXlYairZYqMddH13L

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks