Overview

overview

10

Static

static

10

b0d2a065d7...08.exe

windows7-x64

10

b0d2a065d7...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408.exe

  • Size

    753KB

  • Sample

    241206-dndfmstjhm

  • MD5

    45011233f584317d3450a81d260c2a15

  • SHA1

    ae512c745c512cb52112e6369741a14584a1fd95

  • SHA256

    b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408

  • SHA512

    39e6b275060bebdccd1c1bfef8f1d62a90839a260bb45355a999a38de28d4a6133a7f02585b07f866afa92d6c6a03b4c66f101e11050f7d3b05f9f2cd40af75e

  • SSDEEP

    12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Izr:ansJ39LyjbJkQFMhmC+6GD9I

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408.exe

    • Size

      753KB

    • MD5

      45011233f584317d3450a81d260c2a15

    • SHA1

      ae512c745c512cb52112e6369741a14584a1fd95

    • SHA256

      b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408

    • SHA512

      39e6b275060bebdccd1c1bfef8f1d62a90839a260bb45355a999a38de28d4a6133a7f02585b07f866afa92d6c6a03b4c66f101e11050f7d3b05f9f2cd40af75e

    • SSDEEP

      12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Izr:ansJ39LyjbJkQFMhmC+6GD9I

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks