Overview

overview

10

Static

static

10

c414b0f8be...aN.exe

windows7-x64

10

c414b0f8be...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c414b0f8befd8e0a57bb386fa68d5cea17d21b3c5f2cb1e44474cae46f1176daN

  • Size

    3.5MB

  • Sample

    241106-gdqj1awcql

  • MD5

    419261a8cdf19560d4a39ab434ee5270

  • SHA1

    dabae0f912f2d85f74f4461fb4dd813e6fe1b3d5

  • SHA256

    c414b0f8befd8e0a57bb386fa68d5cea17d21b3c5f2cb1e44474cae46f1176da

  • SHA512

    6ec51e4ea5d66b3fe39528f8074414e46f4212033308b57921a7b56570d45c8b60e18d19ac090c171239a423f5e65fa9ea035a26671286aea262616569437878

  • SSDEEP

    49152:insHyjtk2MYC5GDrzKT4qsEEXJeHuvokx7vDKo80wkSu2l/qtSupzeB/:insmtk2a+K1rOvoqa/Vr/uteB/

Score
10/10
xredbackdoordiscoverymacropersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      c414b0f8befd8e0a57bb386fa68d5cea17d21b3c5f2cb1e44474cae46f1176daN

    • Size

      3.5MB

    • MD5

      419261a8cdf19560d4a39ab434ee5270

    • SHA1

      dabae0f912f2d85f74f4461fb4dd813e6fe1b3d5

    • SHA256

      c414b0f8befd8e0a57bb386fa68d5cea17d21b3c5f2cb1e44474cae46f1176da

    • SHA512

      6ec51e4ea5d66b3fe39528f8074414e46f4212033308b57921a7b56570d45c8b60e18d19ac090c171239a423f5e65fa9ea035a26671286aea262616569437878

    • SSDEEP

      49152:insHyjtk2MYC5GDrzKT4qsEEXJeHuvokx7vDKo80wkSu2l/qtSupzeB/:insmtk2a+K1rOvoqa/Vr/uteB/

    Score
    10/10
    xredbackdoordiscoverymacropersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks