General

  • Target

    4c2e4235cab174859f126a8a623841fa6648e20d71da9519a6cfde0df3d32c62N.exe

  • Size

    96KB

  • Sample

    250202-rfb5haxjdl

  • MD5

    723b432ff0012815d934e96ac5aa1160

  • SHA1

    9cd5f7e42aa96445e3919cc95d2dbe917624955b

  • SHA256

    4c2e4235cab174859f126a8a623841fa6648e20d71da9519a6cfde0df3d32c62

  • SHA512

    537f668f04c4e696df8e5608d6156b5b6f2ec595b89b34df394d60943c49c6291bf2a03c39c9f8e965a7c0a4ac6cb7f18d817df0fd4b3af3657a5dc1222c7507

  • SSDEEP

    1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:TGs8cd8eXlYairZYqMddH13z

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      4c2e4235cab174859f126a8a623841fa6648e20d71da9519a6cfde0df3d32c62N.exe

    • Size

      96KB

    • MD5

      723b432ff0012815d934e96ac5aa1160

    • SHA1

      9cd5f7e42aa96445e3919cc95d2dbe917624955b

    • SHA256

      4c2e4235cab174859f126a8a623841fa6648e20d71da9519a6cfde0df3d32c62

    • SHA512

      537f668f04c4e696df8e5608d6156b5b6f2ec595b89b34df394d60943c49c6291bf2a03c39c9f8e965a7c0a4ac6cb7f18d817df0fd4b3af3657a5dc1222c7507

    • SSDEEP

      1536:TnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxz:TGs8cd8eXlYairZYqMddH13z

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks