General
-
Target
bf7700d0b025ef158f166015ec391ff8cb93a12c3b8644b49948caed69389057
-
Size
4.2MB
-
MD5
6e9cae124971221351f356b3bdad7edb
-
SHA1
5c58ecaba6422ced12338191481db46148f2d2b3
-
SHA256
bf7700d0b025ef158f166015ec391ff8cb93a12c3b8644b49948caed69389057
-
SHA512
9d47d04869ccbd4ea60cbdbb9b6ae4c88442820a12c8184166a23861a346f10804c82d52bf972f6a0936f3b3a1a6d167a7be6d86723692ab14e3fa407f9906dc
-
SSDEEP
98304:jnsmtk2aCu2rd6vFGq/ZkPcdGlGW49VZBXukIWf9RZB:7L/uwd6v8q/2PCGl4DL5IwRZB
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
bf7700d0b025ef158f166015ec391ff8cb93a12c3b8644b49948caed69389057
Headers
Sections