General

  • Target

    eb99b1cd9e8a6f3af2b0d8cacbba0b5d1eb85d57797d8950a543ebbecf895793N.exe

  • Size

    134KB

  • Sample

    250217-drq6xaxrhm

  • MD5

    eb59c001f373ac4b34189cb674096c40

  • SHA1

    be962eb922113a3ce08b7f20c19d0608d386b51f

  • SHA256

    eb99b1cd9e8a6f3af2b0d8cacbba0b5d1eb85d57797d8950a543ebbecf895793

  • SHA512

    8f42dcf612823399326dd8e144f74feff30fab429831f23ee597bbe6df346ff2a2254997e33022d69e5d4d38bc2491e8641855c6a33ab3eeeb720b491d99b243

  • SSDEEP

    1536:gDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:WiRTeH0NqAW6J6f1tqF6dngNmaZC7M

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      eb99b1cd9e8a6f3af2b0d8cacbba0b5d1eb85d57797d8950a543ebbecf895793N.exe

    • Size

      134KB

    • MD5

      eb59c001f373ac4b34189cb674096c40

    • SHA1

      be962eb922113a3ce08b7f20c19d0608d386b51f

    • SHA256

      eb99b1cd9e8a6f3af2b0d8cacbba0b5d1eb85d57797d8950a543ebbecf895793

    • SHA512

      8f42dcf612823399326dd8e144f74feff30fab429831f23ee597bbe6df346ff2a2254997e33022d69e5d4d38bc2491e8641855c6a33ab3eeeb720b491d99b243

    • SSDEEP

      1536:gDfDbhERTatPLTH0NqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwC7M:WiRTeH0NqAW6J6f1tqF6dngNmaZC7M

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks