Overview

overview

10

Static

static

3

2025-04-06...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader

  • Size

    134KB

  • Sample

    250406-wtly3svwgz

  • MD5

    41528258392f55d7580451a0f4f2b5d3

  • SHA1

    7f8a99facb60c29af631d9648f9f9aa48a5b79c6

  • SHA256

    359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9

  • SHA512

    f33d086aeb53ab770a30535dfaa9feb056c99583e055e6670a282586f932aaa863d1579e53bd4a99c23d744eb335faa0416cbdf9a6994b41a5b59d7286379d98

  • SSDEEP

    1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score
10/10
neconyddiscoverypersistencetrojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Targets

    • Target

      2025-04-06_41528258392f55d7580451a0f4f2b5d3_amadey_rhadamanthys_smoke-loader

    • Size

      134KB

    • MD5

      41528258392f55d7580451a0f4f2b5d3

    • SHA1

      7f8a99facb60c29af631d9648f9f9aa48a5b79c6

    • SHA256

      359a1786786b8e0b08c9c52666c51d7198880cfd8d43818d3a1a4e96bdcce8b9

    • SHA512

      f33d086aeb53ab770a30535dfaa9feb056c99583e055e6670a282586f932aaa863d1579e53bd4a99c23d744eb335faa0416cbdf9a6994b41a5b59d7286379d98

    • SSDEEP

      1536:EDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:aiRTeH0iqAW6J6f1tqF6dngNmaZCia

    Score
    10/10
    neconyddiscoverypersistencetrojan

    • Neconyd

      Neconyd is a trojan written in C++.

      trojanneconyd

    • Neconyd family

      neconyd

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks