General
-
Target
d5fc8ced3f8f9a05ba2e172b374d6f4b2ad2f783fa59dd83133d980f83a8b3b1
-
Size
1.9MB
-
MD5
b75a242d017ed6a6b620fee6a257911c
-
SHA1
41642b8d6bc09454037c823c8a8674bb7e16a6ef
-
SHA256
d5fc8ced3f8f9a05ba2e172b374d6f4b2ad2f783fa59dd83133d980f83a8b3b1
-
SHA512
ec13499f41573e9624e1eb655a3c56d88d3f33b442ef10c150f991fd27052841a7087674dd1c46e59332634a6189f8c3e4052e3a0e44e2fd430a9dfdbc8463b0
-
SSDEEP
49152:enscyjtk2MYC5GEeRdIxD9oGhSNqYF200dw9tY4:ensHtk2auRmxD9Rg/5069a4
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
d5fc8ced3f8f9a05ba2e172b374d6f4b2ad2f783fa59dd83133d980f83a8b3b1
Headers
Sections