General

  • Target

    879266d087e8a9d921459ee0b3e37d80ee81f2ad8cf1a573f03fa23a2685ae5dN.exe

  • Size

    134KB

  • Sample

    250202-p4443sslfs

  • MD5

    36c4d2f645f9db603d475063924eb670

  • SHA1

    5629b4c78b8cdb44c74e8ea403554bd01168b8e6

  • SHA256

    879266d087e8a9d921459ee0b3e37d80ee81f2ad8cf1a573f03fa23a2685ae5d

  • SHA512

    ba678c8acea7d20906096ac197d5b6475e9d4bb1d8a1de0c369970ea8bb38f194787d5b4d866c67135ca200c2a808159616070a2ac7f0e7a75233958d27e2c68

  • SSDEEP

    1536:sDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:SiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      879266d087e8a9d921459ee0b3e37d80ee81f2ad8cf1a573f03fa23a2685ae5dN.exe

    • Size

      134KB

    • MD5

      36c4d2f645f9db603d475063924eb670

    • SHA1

      5629b4c78b8cdb44c74e8ea403554bd01168b8e6

    • SHA256

      879266d087e8a9d921459ee0b3e37d80ee81f2ad8cf1a573f03fa23a2685ae5d

    • SHA512

      ba678c8acea7d20906096ac197d5b6475e9d4bb1d8a1de0c369970ea8bb38f194787d5b4d866c67135ca200c2a808159616070a2ac7f0e7a75233958d27e2c68

    • SSDEEP

      1536:sDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCid:SiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks