Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

  • Size

    11.6MB

  • MD5

    c7b7724d301571f07801aca2dd02fa64

  • SHA1

    20e52fb996017fa06dd32c8ab78ad26c3ba4f512

  • SHA256

    31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c

  • SHA512

    71b2eb625289702429661cf632950e62a8a45f30f46c39e92cb0efa5f199ec700a14f67f1bd4dc98537506d6b87ede7d71e64813b3eba3e24e1d71b6bb1f7f74

  • SSDEEP

    196608:ufm81miIMgd2tFFlB/NFRvhug5nO21tZ+6jOiYNqVfcEmEOka4n/HSBGnrDj9IV:ufm81eY3BVjvBNO217+tiYac85a4n/Hq

Score
10/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 31eadfff103e8194b9dc7dcf71f6461dc867469b6e1ba5c5b9e8341c06193d9c
    .zip
  • 狗道周年跳阵营工具.exe
    .exe windows:4 windows x86 arch:x86

    9165ea3e914e03bda3346f13edbd6ccd


    Headers

    Imports

    Sections

  • 驱动/E2EE.ODBC安装器.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 驱动/MySQL ODBC 3.51 Driver.eeodbc
    .gz
  • MySQL ODBC 3.51 Driver.eeodbc

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.