Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    848a57211a4e9886217a303634d0dd55a86c20bee1a2fc801f11b8c8cb230789

  • Size

    6.8MB

  • Sample

    240516-exwh9abf7w

  • MD5

    1bc9d6112e46eca4514b0462f2ae7084

  • SHA1

    d43d6a8b1c516a09c173d76d947294b794b46463

  • SHA256

    848a57211a4e9886217a303634d0dd55a86c20bee1a2fc801f11b8c8cb230789

  • SHA512

    0e7ce63afb15926fd34b027ba67a8c376eab3bef5c5f252b99e82c55d59ba82cb18d8065f68b8415eb8e0f030f4c4d30bfc1d6f3cff9c15d24516b36c33b93f4

  • SSDEEP

    98304:4GdVyVT9nOgmhwra116Qnsmtk2aFZd/iNPS/nugb+XonDXHHtw4Ack:fWT9nO7Ka116uLaT/iNPuZIonzaF

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      848a57211a4e9886217a303634d0dd55a86c20bee1a2fc801f11b8c8cb230789

    • Size

      6.8MB

    • MD5

      1bc9d6112e46eca4514b0462f2ae7084

    • SHA1

      d43d6a8b1c516a09c173d76d947294b794b46463

    • SHA256

      848a57211a4e9886217a303634d0dd55a86c20bee1a2fc801f11b8c8cb230789

    • SHA512

      0e7ce63afb15926fd34b027ba67a8c376eab3bef5c5f252b99e82c55d59ba82cb18d8065f68b8415eb8e0f030f4c4d30bfc1d6f3cff9c15d24516b36c33b93f4

    • SSDEEP

      98304:4GdVyVT9nOgmhwra116Qnsmtk2aFZd/iNPS/nugb+XonDXHHtw4Ack:fWT9nO7Ka116uLaT/iNPuZIonzaF

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks