General
-
Target
c007963ea8a65af4341acc40caac770a3fe2ee6aba76e7bea3285f0bc23700d5N
-
Size
753KB
-
MD5
64e5595cb0a5279ad10739fa5ea76990
-
SHA1
1a1611cd2e34787a48d01eab03db8b923b7221b4
-
SHA256
c007963ea8a65af4341acc40caac770a3fe2ee6aba76e7bea3285f0bc23700d5
-
SHA512
602736c7c3df48d45a7b35b152967ab67e0a29f5a68a7f985739cff96496607d725ca1d1312b36b0fd24512f4ef5291c5006504ec79e4bfdbe7bbd547fb0402d
-
SSDEEP
12288:yMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I4r:ynsJ39LyjbJkQFMhmC+6GD93
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
c007963ea8a65af4341acc40caac770a3fe2ee6aba76e7bea3285f0bc23700d5N
Headers
Sections