xred | 31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

Sharing

Copy URL Twitter E-mail

General

Target
31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c
Size 11.6MB
Sample241121-j9cdcszpfs
SHA256 31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c
MD5 c7b7724d301571f07801aca2dd02fa64
SHA1 20e52fb996017fa06dd32c8ab78ad26c3ba4f512
SHA512 71b2eb625289702429661cf632950e62a8a45f30f46c39e92cb0efa5f199ec700a14f67f1bd4dc98537506d6b87ede7d71e64813b3eba3e24e1d71b6bb1f7f74
SSDEEP 196608:ufm81miIMgd2tFFlB/NFRvhug5nO21tZ+6jOiYNqVfcEmEOka4n/HSBGnrDj9IV:ufm81eY3BVjvBNO217+tiYac85a4n/Hq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred family
xred

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/狗道周年跳阵营工具.exe
unpack001/驱动/E2EE.ODBC安装器.exe

File Explorer

31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

.zip 11.6MB
狗道周年跳阵营工具.exe

.exe 4.7MB
驱动/E2EE.ODBC安装器.exe

.exe 4.8MB
驱动/MySQL ODBC 3.51 Driver.eeodbc

.gz 3.3MB
MySQL ODBC 3.51 Driver.eeodbc

8.4MB

31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

SHA256 31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c
MD5 c7b7724d301571f07801aca2dd02fa64
SHA1 20e52fb996017fa06dd32c8ab78ad26c3ba4f512
SHA512 71b2eb625289702429661cf632950e62a8a45f30f46c39e92cb0efa5f199ec700a14f67f1bd4dc98537506d6b87ede7d71e64813b3eba3e24e1d71b6bb1f7f74
SSDEEP 196608:ufm81miIMgd2tFFlB/NFRvhug5nO21tZ+6jOiYNqVfcEmEOka4n/HSBGnrDj9IV:ufm81eY3BVjvBNO217+tiYac85a4n/Hq
MD5 SHA1 SHA512 SSDEEP

狗道周年跳阵营工具.exe

IMPHASH 9165ea3e914e03bda3346f13edbd6ccd
SHA256 0a0828a1b11c53cf9119efa02549ca184af6e6708bbcb70351c056b1b9b9e26d
MD5 5db7a602f9769566946fe0717d6ebdbe
SHA1 7c212e732023d482e920fe9013339657b5c63ce2
SHA512 6be9286306bfd65bbb1a97d929d5aaa05283983b98a9696f08dd51cf2824f5c712795757cb4ad649b1a9d4e75ecd5dc4de1addc4b3a005fd47fae6af8e07f140
SSDEEP 98304:rbYzWm8ZK+MLgXrPMjA3MDlFlhtjTXSNfYdtSufV/NzngxkTX1L2AwC6cJRKGK:Ptm8ZK+MsXQjA36FlhtPLBfV5fXDwzzd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

驱动/E2EE.ODBC安装器.exe

SHA256 ff11568b5035014c309a5b33f3d167cf08df06fdaf7bc5470227d8327236cba6
MD5 5251f4c9b600a325a4711cf145a6a966
SHA1 a6fb4b906cbc8ed90fd50f1644ec078b3f7b619a
SHA512 9ebc865438c5b7c65672ea1b6f6ca9fa397ed31777b82e6857d4cbc69d38b14dca76258f5810684ee345b3b67a86ebc034e211050cdbf51de7ceaa039bb1b1cf
SSDEEP 98304:xnsmtk2aaIFHgMC6T6F9628sPyYFivvKncMpzJOPBn:NLMG6z28whivVBn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

狗道周年跳阵营工具.exe

kernel32

user32

generic

驱动/E2EE.ODBC安装器.exe

generic

驱动/MySQL ODBC 3.51 Driver.eeodbc

MySQL ODBC 3.51 Driver.eeodbc