General
-
Target
ec57c2026a1179a1dd0e8a1713ac790ed03f7d3b68575f0d2b8d564a4525c9c7N.exe
-
Size
4.3MB
-
MD5
fdcb179d8e355fe774b7714b8f883850
-
SHA1
318e5151f3223733c71a964c22d993a306fbfc5f
-
SHA256
ec57c2026a1179a1dd0e8a1713ac790ed03f7d3b68575f0d2b8d564a4525c9c7
-
SHA512
92ebea2e79bff18f9e3dcdf7a4c3aa88654ce31001256cb3e1474c13dac1aaa53f3574abf2d89c7826116053c7621d285095e1af33db20eeac9331cf64c564f9
-
SSDEEP
98304:unsmtk2amqUYvD+t7iJU1xBsTJBGuNZFX+CxU1iC4ySWNompHI:wLGUYvD+t2+1xsXRU1iC1Syomy
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ec57c2026a1179a1dd0e8a1713ac790ed03f7d3b68575f0d2b8d564a4525c9c7N.exe
Headers
Sections