General

  • Target

    2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205N.exe

  • Size

    5.0MB

  • Sample

    241206-mwvvbszkdp

  • MD5

    a48f1ff8a0fb0f605a31b7f21a7c8540

  • SHA1

    8f52f64159db24c307f8390bd07f3fdc1ecb7462

  • SHA256

    2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205

  • SHA512

    d1220b3510ea08a5cc19e01d45de1d61b4c8c2b104fc3505b38e123d7e7550aa83ba28d75a9e2b59278efaa899747c264e11d1864096a6b0c28c7f7e294d820b

  • SSDEEP

    98304:Pnsmtk2aGkLUHCga1aeKv+NrdW54qbtx/5CPDhGNAzxa8XK6FIPyp:fLqUH/aE6nW54qpxk7hGCwZ6ya

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205N.exe

    • Size

      5.0MB

    • MD5

      a48f1ff8a0fb0f605a31b7f21a7c8540

    • SHA1

      8f52f64159db24c307f8390bd07f3fdc1ecb7462

    • SHA256

      2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205

    • SHA512

      d1220b3510ea08a5cc19e01d45de1d61b4c8c2b104fc3505b38e123d7e7550aa83ba28d75a9e2b59278efaa899747c264e11d1864096a6b0c28c7f7e294d820b

    • SSDEEP

      98304:Pnsmtk2aGkLUHCga1aeKv+NrdW54qbtx/5CPDhGNAzxa8XK6FIPyp:fLqUH/aE6nW54qpxk7hGCwZ6ya

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks