Overview

overview

10

Static

static

10

Loader.exe

windows7-x64

10

Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    2.6MB

  • Sample

    241210-e6bkfaynfm

  • MD5

    9312f8185610b599fbab610623562c65

  • SHA1

    284595f0151a56537c5a02e708b072c43123ab30

  • SHA256

    251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

  • SHA512

    cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa

  • SSDEEP

    49152:InsHyjtk2MYC5GDECG4hRrwCG4hdrHITYbNbNWo4kSH3OqtwIjkqXfd+/9AhD:Insmtk2aZCG4hRECG4hdLIT4bNJFY3OM

Score
10/10
xredbackdoordiscoverymacropersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      Loader.exe

    • Size

      2.6MB

    • MD5

      9312f8185610b599fbab610623562c65

    • SHA1

      284595f0151a56537c5a02e708b072c43123ab30

    • SHA256

      251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

    • SHA512

      cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa

    • SSDEEP

      49152:InsHyjtk2MYC5GDECG4hRrwCG4hdrHITYbNbNWo4kSH3OqtwIjkqXfd+/9AhD:Insmtk2aZCG4hRECG4hdLIT4bNJFY3OM

    Score
    10/10
    xredbackdoordiscoverymacropersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks