General
-
Target
7036d9af1685face5a42401a29a3f0ae3316e069aba73480f59f6fb590fdaa0c
-
Size
1.7MB
-
MD5
48b681e25b5f9c82adbfc2eed4e644cf
-
SHA1
7c4be41399eee4e5357356240b5b84a302d7bbd0
-
SHA256
7036d9af1685face5a42401a29a3f0ae3316e069aba73480f59f6fb590fdaa0c
-
SHA512
23558f8d287ed4cfa4ac5e441d26998e4b89f77c63814a67002c47234df111123403392842c7c80aceb583f0d87bd57366fd53cf88dc6b073b8fec4cf47694bf
-
SSDEEP
24576:2nsJ39LyjbJkQFMhmC+6GD9DGQB+2DR7BWYpcyo44u0aPVBWYpzW:2nsHyjtk2MYC5GDr7Vh102Ti
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
7036d9af1685face5a42401a29a3f0ae3316e069aba73480f59f6fb590fdaa0c
Headers
Sections