Overview

overview

10

Static

static

10

7167adbb22...6N.exe

windows7-x64

10

7167adbb22...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7167adbb22aab40a5627fdc2dd1431491b721c18723f1cc8d8ee55d64cd14576N.exe

  • Size

    940KB

  • Sample

    241129-xp8gys1pct

  • MD5

    7c845bb4efb5f123e541588f3fadaa50

  • SHA1

    4f20c525faca5843b603321cb5e37fae0a9e9e27

  • SHA256

    7167adbb22aab40a5627fdc2dd1431491b721c18723f1cc8d8ee55d64cd14576

  • SHA512

    126e72a65b0067b8c3df507608bc56bda8c66f5cea3ba9f9232de28ac1b824ff53e30b837826aab414f508eeaf15d22a67ad1e8193687ecd4423033ac59f7ad4

  • SSDEEP

    24576:qatawOapJkQFMhmC+6GD9luu1OUjezCkz:Dk2MYC5GDjuukUjezJ

Score
10/10
xredbackdoordefense_evasiondiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      7167adbb22aab40a5627fdc2dd1431491b721c18723f1cc8d8ee55d64cd14576N.exe

    • Size

      940KB

    • MD5

      7c845bb4efb5f123e541588f3fadaa50

    • SHA1

      4f20c525faca5843b603321cb5e37fae0a9e9e27

    • SHA256

      7167adbb22aab40a5627fdc2dd1431491b721c18723f1cc8d8ee55d64cd14576

    • SHA512

      126e72a65b0067b8c3df507608bc56bda8c66f5cea3ba9f9232de28ac1b824ff53e30b837826aab414f508eeaf15d22a67ad1e8193687ecd4423033ac59f7ad4

    • SSDEEP

      24576:qatawOapJkQFMhmC+6GD9luu1OUjezCkz:Dk2MYC5GDjuukUjezJ

    Score
    10/10
    xredbackdoordefense_evasiondiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks