xred | c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80

Resubmissions

29/11/2024, 09:17

241129-k87csaxmcx10

28/12/2023, 10:04

231228-l37xsschf23

Sharing

Copy URL Twitter E-mail

General

Target
c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80
Size 635KB
Sample241129-k87csaxmcx
SHA256 c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80
MD5 69a721295029d0e369dba00449529189
SHA1 fab7bcc144712ec53e99371ec4ff9ccfb1f19a0d
SHA512 7f754133d028fe7bd75a32eaf9858c3f688ae3893b5cf38383c568e8ecdc14ebab321cf74ea71558bcedbccb27527a1aaa76be10c3d49e37f59e14eae1663ad0
SSDEEP 12288:p0BYFpr+X1BNNWeW1XNFKvAw20NMasmgFaM/yBhV0GgywJn8yyfww/pwvYb/:mBYFpqXjPkbS16aFh9gywXgpeYb/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred family
xred

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/em.exe

File Explorer

c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80

.zip 635KB
em.exe

.exe 2.5MB

c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80

SHA256 c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80
MD5 69a721295029d0e369dba00449529189
SHA1 fab7bcc144712ec53e99371ec4ff9ccfb1f19a0d
SHA512 7f754133d028fe7bd75a32eaf9858c3f688ae3893b5cf38383c568e8ecdc14ebab321cf74ea71558bcedbccb27527a1aaa76be10c3d49e37f59e14eae1663ad0
SSDEEP 12288:p0BYFpr+X1BNNWeW1XNFKvAw20NMasmgFaM/yBhV0GgywJn8yyfww/pwvYb/:mBYFpqXjPkbS16aFh9gywXgpeYb/
MD5 SHA1 SHA512 SSDEEP

em.exe

SHA256 a8eea05d025c95fa51597a49564806ddfbadc635bc407c25b04059a1cdc5555a
MD5 ef18fa16022ae67b86b21bb1aa145fc0
SHA1 90aa33fcd1407fc9c672a0b00a3c9c3c2735984f
SHA512 088d7924ffb0f160cccd898f9cca91c410d8b82705f1488fdc3e392437b364a5bf6b11f7c52235e40726eeaec9974eea2f5f75dd5eb17c15a17f3a0ee20fd32b
SSDEEP 24576:JnsJ39LyjbJkQFMhmC+6GD9jk7UHhd1IvGGC0qsu/:JnsHyjtk2MYC5GD7BkGGC0M/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80

em.exe

generic