General
-
Target
9b06aeed5f28bc425f5b920147f8bd3289a63fe82173b294e18d46edbfb4cc01N.exe
-
Size
3.0MB
-
MD5
948ffca7c5355d35abcbda7d11ce9370
-
SHA1
58e8a92cd9ef1594316459eccbe007c82b5f79b0
-
SHA256
9b06aeed5f28bc425f5b920147f8bd3289a63fe82173b294e18d46edbfb4cc01
-
SHA512
724a8fd34e09d2c34a74ed9f303f4a7cb5de281f42beac192fef625d72294573f3936c88e4d83d7499e7e0fbd6cdca3923953c2e34611b804a5933cbb1b65177
-
SSDEEP
49152:KnsHyjtk2MYC5GDRARtcS4sGmG/E8gglu9mPKG34dOTTtDYd8xX56W2ohUZi5mqj:Knsmtk2aZRtQsGmdXkSG3tYO/NUZZqwi
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
9b06aeed5f28bc425f5b920147f8bd3289a63fe82173b294e18d46edbfb4cc01N.exe
Headers
Sections