neconyd | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]e3314e572b12d2d229c01

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.e3314e572b12d2d229c01
Size 61KB
Sample261014-jckngax18k
SHA256 616efe6b6bbe5090bed7cabd398d3e8fc6a9b6273e75d527c99ed3899134371f
MD5 090d4987ea8e3314e572b12d2d229c01
SHA1 89d7c7eb99b8e5b695ed607f55441ed89716cfdc
SHA512 b08cd4594fc74b7e686e0634bc54bef19cb52654de137646b1ed1e68f974b9e7f11cf6b5dfa272ae3f4ecb1a3fbe2ba60b610b4b68caf76c0f606e70bda97d4d
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1D9538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan neconyd

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Family: Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.e3314e572b12d2d229c01

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.e3314e572b12d2d229c01

.exe 61KB

jaffacakes118_HEUR.Trojan.Win32.Generic.e3314e572b12d2d229c01

IMPHASH 08b67a9663d3a8c9505f3b2561bbdd1c
SHA256 616efe6b6bbe5090bed7cabd398d3e8fc6a9b6273e75d527c99ed3899134371f
MD5 090d4987ea8e3314e572b12d2d229c01
SHA1 89d7c7eb99b8e5b695ed607f55441ed89716cfdc
SHA512 b08cd4594fc74b7e686e0634bc54bef19cb52654de137646b1ed1e68f974b9e7f11cf6b5dfa272ae3f4ecb1a3fbe2ba60b610b4b68caf76c0f606e70bda97d4d
SSDEEP 1536:2d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:OdseIOMEZEyFjEOFqTiQm5l/5
TLSH
T1D9538D55B2F9C075E1A309F1697DAA91C9FEBD3826A4D5C7D3101C876EB02D2C23938B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

HttpSendRequestW InternetConnectW HttpOpenRequestW InternetSetPerSiteCookieDecisionW InternetOpenUrlW InternetAttemptConnect InternetOpenW InternetReadFile InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW

shlwapi

StrStrIW PathMatchSpecW PathCombineW wvnsprintfW StrStrIA PathRemoveFileSpecW

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapReAlloc RtlUnwind WideCharToMultiByte MultiByteToWideChar HeapCreate CopyFileW CreateThread WaitForMultipleObjects GetTickCount DeleteFileW CreateProcessW SetUnhandledExceptionFilter ExitProcess GetLastError LoadLibraryW GetProcAddress Sleep VirtualProtect GetPrivateProfileIntW ExpandEnvironmentStringsW GetPrivateProfileStringW FindFirstFileW SetFilePointer SetEndOfFile GetVersionExW HeapAlloc SetWaitableTimer SystemTimeToFileTime CreateWaitableTimerW FindNextFileW HeapFree ReadFile GetModuleFileNameW GetFileTime WaitForSingleObject GetTimeZoneInformation CreateFileW CloseHandle GetFileSizeEx VirtualFree GetProcessHeap GetCurrentDirectoryW VirtualAlloc VirtualQuery GetSystemTime GetFileSize FindClose WriteFile GetLocalTime GetModuleHandleW GetCommandLineW

user32

GetWindowLongW DispatchMessageW GetForegroundWindow CharLowerW CreateWindowExW FindWindowW PeekMessageW SetForegroundWindow GetSystemMetrics MessageBoxW SetWindowPos SetWindowLongW SetParent

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance OleInitialize CoInitialize

oleaut32

SysFreeString VariantInit SysAllocString VariantClear