General
-
Target
Monoxidex86.harmless.exe
-
Size
884KB
-
MD5
189957c510f529fc2021b84ae99f5757
-
SHA1
29f73b40e866f0ddea48e2744a0f9287c30fce02
-
SHA256
753a3eecee5ee27eaf31051bfae24f8c16c91ac83ae128190ef2e13cf2d69c01
-
SHA512
8a328298834bd6dce71c76baf77f6e2660ebb8038a930982e46d84e86b2078981ad095d44644c38650fdc2a29e18fa8ebc12da703a52314f7ad7030df6168fcb
-
SSDEEP
12288:8MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9op2BKwORo/Ej:8nsJ39LyjbJkQFMhmC+6GD9C2BKwcoc
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Monoxidex86.harmless.exe
Headers
Sections