Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bcf974cbd26f9d1657ddb543b51d19a8481a5e0a6ec5145d5c2eb1f41eb50526

  • Size

    2.6MB

  • Sample

    241205-cpx11atjh1

  • MD5

    88f127c51b55843302acbc911590cbec

  • SHA1

    7b7ca91a80031c091e73e84608e8e913877aee14

  • SHA256

    bcf974cbd26f9d1657ddb543b51d19a8481a5e0a6ec5145d5c2eb1f41eb50526

  • SHA512

    d8118e5ec3b81e64854dceea034811ef6fe391ef20efc91c487b501b15102e6857c7eb9c4319defdf3fa618deb488aca2bfc22d2e6a2b83d141612e9818f7548

  • SSDEEP

    49152:InsHyjtk2MYC5GDriCX7AhOnyrSpzdAWtGHD9Fp1uAFnx/f:Insmtk2aUimAhOnQWASGHiAX

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      bcf974cbd26f9d1657ddb543b51d19a8481a5e0a6ec5145d5c2eb1f41eb50526

    • Size

      2.6MB

    • MD5

      88f127c51b55843302acbc911590cbec

    • SHA1

      7b7ca91a80031c091e73e84608e8e913877aee14

    • SHA256

      bcf974cbd26f9d1657ddb543b51d19a8481a5e0a6ec5145d5c2eb1f41eb50526

    • SHA512

      d8118e5ec3b81e64854dceea034811ef6fe391ef20efc91c487b501b15102e6857c7eb9c4319defdf3fa618deb488aca2bfc22d2e6a2b83d141612e9818f7548

    • SSDEEP

      49152:InsHyjtk2MYC5GDriCX7AhOnyrSpzdAWtGHD9Fp1uAFnx/f:Insmtk2aUimAhOnQWASGHiAX

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.