Behavioral task
behavioral1
Sample
6b231ac3720af5af1e7b88d2d73a7f1e8aa75fc8e21ac174284aeeadeca8c92a.exe
Resource
win7-20241010-en
General
-
Target
6b231ac3720af5af1e7b88d2d73a7f1e8aa75fc8e21ac174284aeeadeca8c92a.exe
-
Size
220KB
-
MD5
34d44c3868b91ecd4e0a440dfb241609
-
SHA1
bd3828a215daeb6965763c5026233dacfb38c73d
-
SHA256
6b231ac3720af5af1e7b88d2d73a7f1e8aa75fc8e21ac174284aeeadeca8c92a
-
SHA512
50b02d92f1bcf6fcd1948e25a800c3dfcfe98d802bab9c759b9b44bface44abf6e5c807c57158ce227e55dae5b837536cef02c2be68e64a3c95e6a0e5cda63c5
-
SSDEEP
768:IfMEIvFGvZEr8LFK0ic46N47eSdYAHwmZ9p6JXXlaa5uA3:IfbIvYvZEyFKF6N4yS+AQmZYl/5P
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Neconyd family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b231ac3720af5af1e7b88d2d73a7f1e8aa75fc8e21ac174284aeeadeca8c92a.exe
Files
-
6b231ac3720af5af1e7b88d2d73a7f1e8aa75fc8e21ac174284aeeadeca8c92a.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE