General
-
Target
b6035f08ad42c6b6a1eb5485b6f37249_JaffaCakes118
-
Size
7.3MB
-
MD5
b6035f08ad42c6b6a1eb5485b6f37249
-
SHA1
fbc646e3cfb9660d35b64c971a79d8e5ae96af6e
-
SHA256
3cb9a6df3ff558af97fc1168ca354a86ef572767e20de577b4e875555468717e
-
SHA512
0be632514e30c7917685154c904744a57395e4cbb497c41ad554fbb94af8e1650b636604c25bbdb438b4996fe642db7eebee605c6af46478c2853f2a02aea645
-
SSDEEP
196608:xlzLq78hY37c4/O/Jk875X+n3teA1tSHj/W9:xlzLH+A4GhkyX+n3temtSD/W9
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
b6035f08ad42c6b6a1eb5485b6f37249_JaffaCakes118
-
mumu_setup/MuMuInstaller_1.1.0.4_nochannel_zh-Hans_1573633675.exe
Headers
Sections