General

  • Target

    riptweakcracked.7z

  • Size

    305.3MB

  • MD5

    8b02904f43a13ed8b700e3ea01e5cbda

  • SHA1

    d05fa65537930533e256aeea711f4055770cca1f

  • SHA256

    3adf1a24d2b6be6d1942dfd603dd4535de000fac2929f8eb8fc8ff6a5448ba07

  • SHA512

    b58ffe56e13d59354531a0625a7da6b9146ea5b6015de373278ada495f48762e443310307d6af6981e5e708104b2ccfb97e861678a2b4469dbaa0c48462751ad

  • SSDEEP

    6291456:3A8JrBaB7xIVPrGHzh1cy/UkQEfWCS4zHjabjVkM3z9PeoEbz45sDuz:w8iB7S9wnco8yHjaPVNVe14yDuz

Score
10/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred family
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • riptweakcracked.7z
    .7z
  • riptweakcracked/LICENSE.electron.txt
  • riptweakcracked/LICENSES.chromium.html
  • riptweakcracked/RIP Tweaks Ultimate.exe
    .exe windows:5 windows x64 arch:x64

    d6cd7f66b196ed0d459468372a98eaea


    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/Uninstall RIP Tweaks Ultimate.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • riptweakcracked/chrome_100_percent.pak
  • riptweakcracked/chrome_200_percent.pak
  • riptweakcracked/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    dc71769f237c0a3ba38879380c54a4e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    14338d2168d869b1b53d66354179e8c5


    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/icudtl.dat
  • riptweakcracked/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    dd9b4582ca44f105f31baaa5f5b9e03d


    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/locales/af.pak
  • riptweakcracked/locales/am.pak
  • riptweakcracked/locales/ar.pak
  • riptweakcracked/locales/bg.pak
  • riptweakcracked/locales/bn.pak
  • riptweakcracked/locales/ca.pak
  • riptweakcracked/locales/cs.pak
  • riptweakcracked/locales/da.pak
  • riptweakcracked/locales/de.pak
  • riptweakcracked/locales/el.pak
  • riptweakcracked/locales/en-GB.pak
  • riptweakcracked/locales/en-US.pak
  • riptweakcracked/locales/es-419.pak
  • riptweakcracked/locales/es.pak
  • riptweakcracked/locales/et.pak
  • riptweakcracked/locales/fa.pak
  • riptweakcracked/locales/fi.pak
  • riptweakcracked/locales/fil.pak
  • riptweakcracked/locales/fr.pak
  • riptweakcracked/locales/gu.pak
  • riptweakcracked/locales/he.pak
  • riptweakcracked/locales/hi.pak
  • riptweakcracked/locales/hr.pak
  • riptweakcracked/locales/hu.pak
  • riptweakcracked/locales/id.pak
  • riptweakcracked/locales/it.pak
  • riptweakcracked/locales/ja.pak
  • riptweakcracked/locales/kn.pak
  • riptweakcracked/locales/ko.pak
  • riptweakcracked/locales/lt.pak
  • riptweakcracked/locales/lv.pak
  • riptweakcracked/locales/ml.pak
  • riptweakcracked/locales/mr.pak
  • riptweakcracked/locales/ms.pak
  • riptweakcracked/locales/nb.pak
  • riptweakcracked/locales/nl.pak
  • riptweakcracked/locales/pl.pak
  • riptweakcracked/locales/pt-BR.pak
  • riptweakcracked/locales/pt-PT.pak
  • riptweakcracked/locales/ro.pak
  • riptweakcracked/locales/ru.pak
  • riptweakcracked/locales/sk.pak
  • riptweakcracked/locales/sl.pak
  • riptweakcracked/locales/sr.pak
  • riptweakcracked/locales/sv.pak
  • riptweakcracked/locales/sw.pak
  • riptweakcracked/locales/ta.pak
  • riptweakcracked/locales/te.pak
  • riptweakcracked/locales/th.pak
  • riptweakcracked/locales/tr.pak
  • riptweakcracked/locales/uk.pak
  • riptweakcracked/locales/ur.pak
  • riptweakcracked/locales/vi.pak
  • riptweakcracked/locales/zh-CN.pak
  • riptweakcracked/locales/zh-TW.pak
  • riptweakcracked/readme me.txt
  • riptweakcracked/resources.pak
  • riptweakcracked/resources/._cache_elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections

  • riptweakcracked/resources/app.asar
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/LICENSE
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
    .js .sh linux
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
    .exe windows:6 windows x64 arch:x64

    eeb7f67cdfafb9b360c15895e97250f1


    Headers

    Imports

    Sections

  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/authors.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/config.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/help.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/logo.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/options.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/topics.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/usage.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/doc/cli/whoami.txt
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/help/index.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/index.js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/index.js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/match.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/run.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/signals.js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/monitor/watch.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/nodemon.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/rules/add.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/rules/index.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/rules/parse.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/spawn.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/bus.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/clone.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/colour.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/index.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/log.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/utils/merge.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/lib/version.js
    .js
  • riptweakcracked/resources/app.asar.unpacked/node_modules/nodemon/package.json
  • riptweakcracked/resources/elevate.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • riptweakcracked/resources/mp3/login.mp3
  • riptweakcracked/snapshot_blob.bin
  • riptweakcracked/v8_context_snapshot.bin
  • riptweakcracked/vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    6d7b823ac45e01133a6ba8c35160fef1


    Headers

    Imports

    Exports

    Sections

  • riptweakcracked/vk_swiftshader_icd.json
  • riptweakcracked/vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    7b5a9d0612e84464d9b810b02dd3245e


    Headers

    Imports

    Exports

    Sections