Overview

overview

10

Static

static

3

d07f214246...2N.exe

windows7-x64

10

d07f214246...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d07f214246c81acfda423ed9d77f6ff5fb6e901897bfcab90b4a5acb66fe0732N

  • Size

    9.7MB

  • Sample

    241106-v9swwsvfqj

  • MD5

    ab44ddf2ab8b96d5800cdf8750a7d3b0

  • SHA1

    610ffbe93f0f29c5e57a8ddd760f8c6555fbfc90

  • SHA256

    d07f214246c81acfda423ed9d77f6ff5fb6e901897bfcab90b4a5acb66fe0732

  • SHA512

    16d0876d033c2c31c426005d6d82ab49427e93533f436275de72ba9339d4e392317e9c546abad2e6dbb7b6bddf7955134eba89cd7e5f4d10725228adfaf91f58

  • SSDEEP

    196608:llCUIBjwlCUIBjGlCUIBj0lCUIBjHlCUIBj5lCUIBj:rGBj4GBjOGBjEGBjFGBjHGBj

Score
10/10
darkcloudxredbackdoordiscoverypersistencestealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot7791323838:AAE3VAK5D-6z6zW2W49g82tPlNqRUAWW6SI/sendMessage?chat_id=6595599138

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      d07f214246c81acfda423ed9d77f6ff5fb6e901897bfcab90b4a5acb66fe0732N

    • Size

      9.7MB

    • MD5

      ab44ddf2ab8b96d5800cdf8750a7d3b0

    • SHA1

      610ffbe93f0f29c5e57a8ddd760f8c6555fbfc90

    • SHA256

      d07f214246c81acfda423ed9d77f6ff5fb6e901897bfcab90b4a5acb66fe0732

    • SHA512

      16d0876d033c2c31c426005d6d82ab49427e93533f436275de72ba9339d4e392317e9c546abad2e6dbb7b6bddf7955134eba89cd7e5f4d10725228adfaf91f58

    • SSDEEP

      196608:llCUIBjwlCUIBjGlCUIBj0lCUIBjHlCUIBj5lCUIBj:rGBj4GBjOGBjEGBjFGBjHGBj

    Score
    10/10
    darkcloudxredbackdoordiscoverypersistencestealer

    • DarkCloud

      An information stealer written in Visual Basic.

      stealerdarkcloud

    • Darkcloud family

      darkcloud

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks