General

  • Target

    ad271988a4c23c57433ddca72899feb71e558e0730aa4b55841db16d2062cfd5N.exe

  • Size

    758KB

  • Sample

    241216-a9wybsvrc1

  • MD5

    271790b1e2bfafa50891100b8239f8d0

  • SHA1

    546ac375122af7ece21c678772831c46eeb804ab

  • SHA256

    ad271988a4c23c57433ddca72899feb71e558e0730aa4b55841db16d2062cfd5

  • SHA512

    60b5575ab82a4710bf822d99462d952eda1ed893191c26cb537f669a2f1549596c4d1648394284de40472c26d938ee5d889a03ba7d85d4d1045346fb252105ff

  • SSDEEP

    12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V98Oj:qnsJ39LyjbJkQFMhmC+6GD9J

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      ad271988a4c23c57433ddca72899feb71e558e0730aa4b55841db16d2062cfd5N.exe

    • Size

      758KB

    • MD5

      271790b1e2bfafa50891100b8239f8d0

    • SHA1

      546ac375122af7ece21c678772831c46eeb804ab

    • SHA256

      ad271988a4c23c57433ddca72899feb71e558e0730aa4b55841db16d2062cfd5

    • SHA512

      60b5575ab82a4710bf822d99462d952eda1ed893191c26cb537f669a2f1549596c4d1648394284de40472c26d938ee5d889a03ba7d85d4d1045346fb252105ff

    • SSDEEP

      12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V98Oj:qnsJ39LyjbJkQFMhmC+6GD9J

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.