Overview

overview

10

Static

static

10

MSRX.7z

windows7-x64

10

MSRX.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MSRX.7z

  • Size

    591KB

  • MD5

    63b8469f969f26dba70a4017c8efa341

  • SHA1

    fb1f0f0bae8f5c2a67ff0d650a192058dd006de0

  • SHA256

    447c72c5138078fc11668200f09edaff028ceb40097e409b3ff49125fcc79c9a

  • SHA512

    ddff04f1c17e6b3a53b2b1f8b9085cb1e5548f9501017123bfd3bc450789265efa9c43f9d9c4cd825ba80a7e085a2f6ac98009ca8f3ac17b1b066a88d50f2972

  • SSDEEP

    12288:vlWrgFvUlZTm25tRGIxNDZCvcYqAZ+IJuxWKxo9sZBsv0r1/85Q:dWreYTj5tRGIRCvcEZ+s+9Z6cr98q

Score
10/10
xred

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred family
    xred
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • MSRX.7z
    .7z
  • MSRX/MSRX.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • MSRX/MagAPI.dll
    .dll windows:4 windows x86 arch:x86

    fed4ccf93c8bceb0c40425d51047de27


    Headers

    Imports

    Exports

    Sections

  • MSRX/Record1.txt
  • MSRX/Uninstall/IRIMG1.JPG
    .jpg
  • MSRX/Uninstall/IRIMG2.JPG
    .jpg
  • MSRX/Uninstall/uninstall.dat
  • MSRX/Uninstall/uninstall.xml