General
-
Target
0ba39629c14ed6bf0a6df55ba5070a87241a1c8a42fdb35c551ad5c906d8035a
-
Size
390KB
-
MD5
638b99a45ee691f4d54455f0bfb0cc83
-
SHA1
5c11743d400027b9d757e9bf7fbca6e52cb35831
-
SHA256
0ba39629c14ed6bf0a6df55ba5070a87241a1c8a42fdb35c551ad5c906d8035a
-
SHA512
102d199117b59cca04529cb7c878675dfed54dd9a5e735d3e1268a9da1619ff4c1d8fb5925d3d8d56c4e8608282b55960e5488304699d9ae3cc873c272f9b6f1
-
SSDEEP
6144:5RbUptK1IUf99qfHoDHEi8OwP7dr5F7L7QTb404HgMCm4PSesSENFr6i5Oywj7Il:5MiZf+2HENfNAMisFmi5Ov3MkpySttCf
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0ba39629c14ed6bf0a6df55ba5070a87241a1c8a42fdb35c551ad5c906d8035a
-
Synaptics.exe
Headers
Sections