General
-
Target
890db792f39b9a133706de13c2d54a9a2d4e783ca9698b537a80a7416d9cb0fe.exe
-
Size
853KB
-
MD5
4c98c7a78bd1785505f062c1b5d3acd4
-
SHA1
3a359d06901aa4298a8db6070901197dec97001a
-
SHA256
890db792f39b9a133706de13c2d54a9a2d4e783ca9698b537a80a7416d9cb0fe
-
SHA512
3ee1e620c0253d6dd51832259f5547776aeaa2f4d454d2453e707470cdc361dfc5685fcb30f20ca7b7928c48f0f7e13121401efd9434c30a6084e8882f771c80
-
SSDEEP
24576:xnsJ39LyjbJkQFMhmC+6GD9pqra3PCvXvY:xnsHyjtk2MYC5GDkvY
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
890db792f39b9a133706de13c2d54a9a2d4e783ca9698b537a80a7416d9cb0fe.exe
Headers
Sections