General

  • Target

    1087e81bba840ba1edf126812ec722507422ea1b3f1fb600f5e43d5b78d8709f.exe

  • Size

    134KB

  • Sample

    250202-mf821sxmey

  • MD5

    6ac7063420ff8401c6844a36b2dd9322

  • SHA1

    1a326c3f7fb00c7a0abee0bf8c361391317005e9

  • SHA256

    1087e81bba840ba1edf126812ec722507422ea1b3f1fb600f5e43d5b78d8709f

  • SHA512

    ae8be00d29ff329d9411806a1e1117bf560f7689fca1b7506fd4e26f34d5efa65fcdf89573eabd083dcc2479c84e7ca0741e55d22a33102c9ff4bd807959353b

  • SSDEEP

    1536:MDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:yiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      1087e81bba840ba1edf126812ec722507422ea1b3f1fb600f5e43d5b78d8709f.exe

    • Size

      134KB

    • MD5

      6ac7063420ff8401c6844a36b2dd9322

    • SHA1

      1a326c3f7fb00c7a0abee0bf8c361391317005e9

    • SHA256

      1087e81bba840ba1edf126812ec722507422ea1b3f1fb600f5e43d5b78d8709f

    • SHA512

      ae8be00d29ff329d9411806a1e1117bf560f7689fca1b7506fd4e26f34d5efa65fcdf89573eabd083dcc2479c84e7ca0741e55d22a33102c9ff4bd807959353b

    • SSDEEP

      1536:MDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCin:yiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks