Overview

overview

10

Static

static

3

fcbacfa755...18.exe

windows7-x64

10

fcbacfa755...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fcbacfa75535c57e7b59d6ce1dca4ce1_JaffaCakes118

  • Size

    757KB

  • Sample

    240420-n7lw8sha2s

  • MD5

    fcbacfa75535c57e7b59d6ce1dca4ce1

  • SHA1

    0d506cfa6a949a5a47186e2562f7ba9c7c8b6afa

  • SHA256

    01898703b913d1770ffface5473129ed3552297d498eee947f02fcdc950d540b

  • SHA512

    6752b4dae9a992ff6dc97396971af443897c7d36364fd7ae604cc8efd4085e70ebe4e199b16f0dbae573edb2bd97b65c69a6c80b16c2ea1f9dc74c889c4f6b22

  • SSDEEP

    12288:2MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nZcm:2nsJ39LyjbJkQFMhmC+6GD9nn

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      fcbacfa75535c57e7b59d6ce1dca4ce1_JaffaCakes118

    • Size

      757KB

    • MD5

      fcbacfa75535c57e7b59d6ce1dca4ce1

    • SHA1

      0d506cfa6a949a5a47186e2562f7ba9c7c8b6afa

    • SHA256

      01898703b913d1770ffface5473129ed3552297d498eee947f02fcdc950d540b

    • SHA512

      6752b4dae9a992ff6dc97396971af443897c7d36364fd7ae604cc8efd4085e70ebe4e199b16f0dbae573edb2bd97b65c69a6c80b16c2ea1f9dc74c889c4f6b22

    • SSDEEP

      12288:2MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nZcm:2nsJ39LyjbJkQFMhmC+6GD9nn

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks