General
-
Target
0a362d64c972d64ba6eadebfc7e949a4967319d133a4aa38cb3de1e54e961cbeN.exe
-
Size
753KB
-
MD5
952deed7ef28bfcd068e18daaccf0900
-
SHA1
5858d3090d9a64e0aaf515970ff60068b714fa53
-
SHA256
0a362d64c972d64ba6eadebfc7e949a4967319d133a4aa38cb3de1e54e961cbe
-
SHA512
20fe8678627bf68707c8e68335e73e54bf8f4a51f8625099c6ea95519b4f5d563535999dfb69bcf2d6b32979eb60bca63c288aee29505cf1a8110b6c5268299b
-
SSDEEP
12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IEr:ansJ39LyjbJkQFMhmC+6GD9H
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0a362d64c972d64ba6eadebfc7e949a4967319d133a4aa38cb3de1e54e961cbeN.exe
Headers
Sections