General

  • Target

    eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe

  • Size

    1.5MB

  • Sample

    241216-qf8b9s1mdw

  • MD5

    23176611a7592536eb073ac16573e440

  • SHA1

    15b9e3ddaaaff9a56086c4e0a2ad7c0afe08f47c

  • SHA256

    eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfd

  • SHA512

    78163f8ff5986dcc5afdb6db2901c01fd7a8de091b1c104abcec379d14ea259e4c2fdf0ff3f714119a171d8f9a26b56c00a68d95761b877a41dfac375aefa318

  • SSDEEP

    24576:insJ39LyjbJkQFMhmC+6GD9bUGJBSZttoGQljjfuCy9wQ6an7:insHyjtk2MYC5GDQoGQljL+

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe

    • Size

      1.5MB

    • MD5

      23176611a7592536eb073ac16573e440

    • SHA1

      15b9e3ddaaaff9a56086c4e0a2ad7c0afe08f47c

    • SHA256

      eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfd

    • SHA512

      78163f8ff5986dcc5afdb6db2901c01fd7a8de091b1c104abcec379d14ea259e4c2fdf0ff3f714119a171d8f9a26b56c00a68d95761b877a41dfac375aefa318

    • SSDEEP

      24576:insJ39LyjbJkQFMhmC+6GD9bUGJBSZttoGQljjfuCy9wQ6an7:insHyjtk2MYC5GDQoGQljL+

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Suspicious Office macro

      Office document equipped with macros.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks