Overview

overview

10

Static

static

10

386f41476b...59.exe

windows10-2004-x64

10

Resubmissions

29-11-2024 09:10

241129-k5ajmsslgj 10

30-12-2023 18:56

231230-xlfb1abgck 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    386f41476b4e6f9d55fb0c3de0d89259.exe

  • Size

    2.9MB

  • MD5

    386f41476b4e6f9d55fb0c3de0d89259

  • SHA1

    bd24870be3930ccd5d7920d81354585bca9e9b38

  • SHA256

    1d6c8100dff3e2e28678a0c696811df9a819638d20e60f503aa67fc999517a85

  • SHA512

    bb18b990bd2234b20bc5a5ad27a3d310947a7dd5b2f2d5983371435c00598e439af46594aadbf76231538713eed14ee3a675ce91ce472082ad1de4a34eee0085

  • SSDEEP

    49152:jHyjtk2MYC5GDZHyjtk2MYC5GDhnJfwQDBBvURFuukUjez+PpQRqs3+n+n9:jmtk2aQmtk2awnJIAuDcUjeCBQRqs3+2

Score
10/10
neshtaxred

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect Neshta payload 1 IoCs
  • Neshta family
    neshta
  • Xred family
    xred
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 386f41476b4e6f9d55fb0c3de0d89259.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections