General
-
Target
b526d210f800d1d9a2f466224a977343d59f679eaaf16b9bcda4d5196d810de2
-
Size
1.2MB
-
MD5
8fbcc3f3038677646fb2e8838d48f14a
-
SHA1
ffc3b09143e7e4322c1effee531329be6d104229
-
SHA256
b526d210f800d1d9a2f466224a977343d59f679eaaf16b9bcda4d5196d810de2
-
SHA512
91cf9d10d6aae9f70323cc1e136b4b6fc5e281c06af5c374cdcb2334b084f45b7abc5b1507bd08ed56bac62766d9eb39168dd409d8bb53ac9ed93ed8e1612b91
-
SSDEEP
24576:TJ39LyjbJkQFMhmC+6GD9JA+vSoqYAQmZoftn8ln9:THyjtk2MYC5GDfBqoqYFm098n9
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Detect Neshta payload 1 IoCs
-
Neshta family
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
b526d210f800d1d9a2f466224a977343d59f679eaaf16b9bcda4d5196d810de2
Headers
Sections