General

  • Target

    e1a1b03a866b969f10718ad5a1541a7edde8ebeadfb26c89f3f81c3988e5e69cN.exe

  • Size

    96KB

  • Sample

    250224-v28mdavnw8

  • MD5

    8e73e501734b63cb8cadc886e05bae70

  • SHA1

    d605f1278198f3d02740ca868270a2291143aebb

  • SHA256

    e1a1b03a866b969f10718ad5a1541a7edde8ebeadfb26c89f3f81c3988e5e69c

  • SHA512

    d1427314fe7609ec33a489cb5e6b13b1d1bba9e25b3b172b36de9e7db9b55c8c1db976e57789c094ec43ff0d0a8451173807a7b369954cf5fd6d4effd33bc61c

  • SSDEEP

    1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:xGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      e1a1b03a866b969f10718ad5a1541a7edde8ebeadfb26c89f3f81c3988e5e69cN.exe

    • Size

      96KB

    • MD5

      8e73e501734b63cb8cadc886e05bae70

    • SHA1

      d605f1278198f3d02740ca868270a2291143aebb

    • SHA256

      e1a1b03a866b969f10718ad5a1541a7edde8ebeadfb26c89f3f81c3988e5e69c

    • SHA512

      d1427314fe7609ec33a489cb5e6b13b1d1bba9e25b3b172b36de9e7db9b55c8c1db976e57789c094ec43ff0d0a8451173807a7b369954cf5fd6d4effd33bc61c

    • SSDEEP

      1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:xGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks