Overview

overview

10

Static

static

10

bef2069b4e...e6.exe

windows7-x64

10

bef2069b4e...e6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bef2069b4ea34a3259f3e252d0a920da19109834c0a6743381b6050c9857e4e6.exe

  • Size

    1.7MB

  • Sample

    241123-rnv8caspel

  • MD5

    4844b5fa1fd64dd7f53c96a906e79112

  • SHA1

    741a6ba63f5b7adfe988a86cc0e05fb797c6e52c

  • SHA256

    bef2069b4ea34a3259f3e252d0a920da19109834c0a6743381b6050c9857e4e6

  • SHA512

    280153990f0e28cf58bf7abf262e84d8b0ecb29b786f17f3798e4c06064d31818e99b292a5e5cd263b3b6644e9e920845071e77c49a63565d0eaa06a5252c2e4

  • SSDEEP

    49152:WnsHyjtk2MYC5GDAOv5F4LA7tCDehDlhxsY1qL:Wnsmtk2aO5F48pCDeTDUL

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      bef2069b4ea34a3259f3e252d0a920da19109834c0a6743381b6050c9857e4e6.exe

    • Size

      1.7MB

    • MD5

      4844b5fa1fd64dd7f53c96a906e79112

    • SHA1

      741a6ba63f5b7adfe988a86cc0e05fb797c6e52c

    • SHA256

      bef2069b4ea34a3259f3e252d0a920da19109834c0a6743381b6050c9857e4e6

    • SHA512

      280153990f0e28cf58bf7abf262e84d8b0ecb29b786f17f3798e4c06064d31818e99b292a5e5cd263b3b6644e9e920845071e77c49a63565d0eaa06a5252c2e4

    • SSDEEP

      49152:WnsHyjtk2MYC5GDAOv5F4LA7tCDehDlhxsY1qL:Wnsmtk2aO5F48pCDeTDUL

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks