General
-
Target
2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205N.exe
-
Size
5.0MB
-
MD5
a48f1ff8a0fb0f605a31b7f21a7c8540
-
SHA1
8f52f64159db24c307f8390bd07f3fdc1ecb7462
-
SHA256
2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205
-
SHA512
d1220b3510ea08a5cc19e01d45de1d61b4c8c2b104fc3505b38e123d7e7550aa83ba28d75a9e2b59278efaa899747c264e11d1864096a6b0c28c7f7e294d820b
-
SSDEEP
98304:Pnsmtk2aGkLUHCga1aeKv+NrdW54qbtx/5CPDhGNAzxa8XK6FIPyp:fLqUH/aE6nW54qpxk7hGCwZ6ya
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2b0589ae1fd9ec761d562a5f01d0794a194c5079ec56394d79d0d538058d4205N.exe
Headers
Sections