Overview

overview

10

Static

static

10

e7c3247a0f...eN.exe

windows7-x64

10

e7c3247a0f...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe

  • Size

    2.5MB

  • Sample

    241119-xv8d5szgrf

  • MD5

    048bc26f865c89de0e2925b5085ac680

  • SHA1

    b36c32e65fdbfcd03e044a61fa58a556b918c069

  • SHA256

    e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e

  • SHA512

    dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde

  • SSDEEP

    49152:unsHyjtk2MYC5GDmSoZr3GzErU7fST52n6zRf9J:unsmtk2a1jazh7fDmRfD

Score
10/10
xredbackdoordiscoverypersistenceupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe

    • Size

      2.5MB

    • MD5

      048bc26f865c89de0e2925b5085ac680

    • SHA1

      b36c32e65fdbfcd03e044a61fa58a556b918c069

    • SHA256

      e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e

    • SHA512

      dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde

    • SSDEEP

      49152:unsHyjtk2MYC5GDmSoZr3GzErU7fST52n6zRf9J:unsmtk2a1jazh7fDmRfD

    Score
    10/10
    xredbackdoordiscoverypersistenceupx

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks