General
-
Target
2bfe34a23028bcac1bc9d6506ff4cbd1d501c24731306aa710d09552015f9f1b
-
Size
744KB
-
MD5
e1e65597b27eb04ff9cf797ba76c9a47
-
SHA1
a2bdebf1891b668f87d5e7683ac01347fb0ea708
-
SHA256
2bfe34a23028bcac1bc9d6506ff4cbd1d501c24731306aa710d09552015f9f1b
-
SHA512
61ec3731a0b2bba95569a23c80858a98009c0b8e6c17c2c67e44deb04e9216ed86cb1791247a5b40b35ade0dc09a5a0bc58b1b185e3ea78c5a1d262a2e2e2484
-
SSDEEP
12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9PU:vnsJ39LyjbJkQFMhmC+6GD98
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2bfe34a23028bcac1bc9d6506ff4cbd1d501c24731306aa710d09552015f9f1b
Headers
Sections