Resubmissions

11-11-2024 03:14

241111-dreswavmgp 10

General

  • Target

    a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

  • Size

    125.6MB

  • MD5

    4f662505b8b99848b4a76d8370f54b85

  • SHA1

    855c7461bbc84a54a30ec63be4b8343fca64b20b

  • SHA256

    a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

  • SHA512

    1a5310b7c0b4a946c3f00b09eb2a822b4d0261dce0939b645ac494b32e59fe601eb9305a392a6243be840af7b576dcac4386c95213bfa610d93b4a83abe22fc2

  • SSDEEP

    3145728:UEVDbfmohyN+c38NljFXjmnIqfyyCHOU9ZJrMBn2v:hD5c9OzOIqKVLv

Score
10/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred family
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 34 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 10 IoCs

Files

  • a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71
    .rar
  • 1.bin.zip
    .zip

    Password: infected

  • 1.bin
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • 1.rar
    .rar
  • VPN/VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/1337/VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $1/1337/joinResult.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/1337/1111.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • $1/1337/Clipper.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • VPN/xNet.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • 2019-09-02_22-41-10.bin
    .exe windows:5 windows x86 arch:x86

    0b940f4d2992021389a241ab8513fc6b


    Headers

    Imports

    Sections

  • 31.bin
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • 3DMark 11 Advanced Edition.bin
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • Archive.zip__ccacaxs2tbz2t6ob3e.bin
    .exe windows:5 windows x86 arch:x86

    ecc8b2d72205d5666936947a45fa8392


    Headers

    Imports

    Sections

  • CVE-2018-15982_PoC.swf
  • CVWSHSetup[1].bin.zip
    .zip

    Password: infected

  • WSHSetup[1].bin
    .exe windows:5 windows x86 arch:x86

    3c977911c8eee24abac5edc906e5e72c


    Headers

    Imports

    Sections

  • DiskInternals_Uneraser_v5_keygen.bin
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • ForceOp 2.8.7 - By RaiSence.bin
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • HYDRA.bin
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Headers

    Imports

    Sections

  • #/power.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • #/sant.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • #/ufx.exe
    .exe windows:5 windows x86 arch:x86

    3eaa732d4dae53340f9646bdd85dac41


    Headers

    Imports

    Sections

  • #/va.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Keygen.bin
    .exe windows:4 windows x86 arch:x86

    06ac1f21ee2a357ffb0dd7db52cbbb13


    Headers

    Imports

    Sections

  • Lonelyscreen.1.2.9.keygen.by.Paradox.zip
    .zip
  • LtHv0O2KZDK4M637.bin
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • OnlineInstaller.bin
    .exe windows:5 windows x86 arch:x86

    5bd730b74335de2d8c76ffbc12562b9c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $1/1337/VyprVPN.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $1/1337/joinResult.exe
    .exe windows:4 windows x86 arch:x86

    4f67aeda01a0484282e8c59006b0b352


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • WSHSetup[1].bin
    .exe windows:5 windows x86 arch:x86

    3c977911c8eee24abac5edc906e5e72c


    Headers

    Imports

    Sections

  • api
    .exe windows:5 windows x86 arch:x86

    aea9c61b49d66485f9f13c0f478d0b02


    Code Sign

    Headers

    Imports

    Sections

  • efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
    .js
  • good.bin
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • infected dot net installer.bin
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • update.bin
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • vir1.xls
    .xlsx .xls office2007
  • xNet.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections