General

  • Target

    61e75d951ba642fc057bb7b0b97fa0f4a63fe6dfb277080b33b1209048cc6dc2N.exe

  • Size

    96KB

  • Sample

    250224-x5dmhszrv3

  • MD5

    af489875957b7980de9e7b9e657c6c20

  • SHA1

    6e7dd8707e18624e41a4d2f57da6d905d940c970

  • SHA256

    61e75d951ba642fc057bb7b0b97fa0f4a63fe6dfb277080b33b1209048cc6dc2

  • SHA512

    e453687d958a9895b6f82bc221ff5ac7346c2a5175003c213d561a2306995e16a45b6ca2b282807a717abe4dd7ac749b262f73346157400f25d07a30cd38d72a

  • SSDEEP

    1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:OGs8cd8eXlYairZYqMddH13b

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      61e75d951ba642fc057bb7b0b97fa0f4a63fe6dfb277080b33b1209048cc6dc2N.exe

    • Size

      96KB

    • MD5

      af489875957b7980de9e7b9e657c6c20

    • SHA1

      6e7dd8707e18624e41a4d2f57da6d905d940c970

    • SHA256

      61e75d951ba642fc057bb7b0b97fa0f4a63fe6dfb277080b33b1209048cc6dc2

    • SHA512

      e453687d958a9895b6f82bc221ff5ac7346c2a5175003c213d561a2306995e16a45b6ca2b282807a717abe4dd7ac749b262f73346157400f25d07a30cd38d72a

    • SSDEEP

      1536:OnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxb:OGs8cd8eXlYairZYqMddH13b

    • Neconyd

      Neconyd is a trojan written in C++.

    • Neconyd family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks