General

  • Target

    d473b502e0b7b71713870b1a0de94a37bfa68336adea76ef00ea2e0e993f287bN.exe

  • Size

    134KB

  • Sample

    250207-1zqlnszpe1

  • MD5

    a5a67f612b5a17a66c725b8269528500

  • SHA1

    be4760955ba37cf1506dbea0fcb47601a8a28e16

  • SHA256

    d473b502e0b7b71713870b1a0de94a37bfa68336adea76ef00ea2e0e993f287b

  • SHA512

    420c515f8b90f90b6a0a2845ab173e3298ff8bf248b36abcb61a176bd8ec03d4343f55076a8c1b866f6319004cd5553123a502ffe9cc22e6d8338adcfd00d67d

  • SSDEEP

    1536:MDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:yiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      d473b502e0b7b71713870b1a0de94a37bfa68336adea76ef00ea2e0e993f287bN.exe

    • Size

      134KB

    • MD5

      a5a67f612b5a17a66c725b8269528500

    • SHA1

      be4760955ba37cf1506dbea0fcb47601a8a28e16

    • SHA256

      d473b502e0b7b71713870b1a0de94a37bfa68336adea76ef00ea2e0e993f287b

    • SHA512

      420c515f8b90f90b6a0a2845ab173e3298ff8bf248b36abcb61a176bd8ec03d4343f55076a8c1b866f6319004cd5553123a502ffe9cc22e6d8338adcfd00d67d

    • SSDEEP

      1536:MDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCiH:yiRTeH0iqAW6J6f1tqF6dngNmaZCiaI

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks