General

  • Target

    644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe

  • Size

    134KB

  • Sample

    250202-kjbjtatncs

  • MD5

    db4096d708ae42fa2a1ab53cd97147e4

  • SHA1

    77ca3ab0ce433f948db8e9f741109d4fea005f99

  • SHA256

    644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9

  • SHA512

    08ddf0da7f5e01facc945dae786298dd100d56859826261c0b83bc4b56c270dfc40f24ac349a620f91584c993b7a2c8537209c8ccffa2036ca7e972dd87c3587

  • SSDEEP

    1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi9:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9.exe

    • Size

      134KB

    • MD5

      db4096d708ae42fa2a1ab53cd97147e4

    • SHA1

      77ca3ab0ce433f948db8e9f741109d4fea005f99

    • SHA256

      644992c2ae225b6e8d30f395f4da0430037f65293c052f771db508b62fcfa4c9

    • SHA512

      08ddf0da7f5e01facc945dae786298dd100d56859826261c0b83bc4b56c270dfc40f24ac349a620f91584c993b7a2c8537209c8ccffa2036ca7e972dd87c3587

    • SSDEEP

      1536:SDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCi9:EiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks