General
-
Target
30fb5b132c6d574c7fdfc74baf3b2abea96d76906375389bccb395351a5d79cfN.exe
-
Size
793KB
-
MD5
b21d41b221f1a20dde8c7f1c9b275090
-
SHA1
407fdd6ce4ffb8c80d88f9f91bfb3021b61e0ab3
-
SHA256
30fb5b132c6d574c7fdfc74baf3b2abea96d76906375389bccb395351a5d79cf
-
SHA512
85a3e9ef3e75052d4ce15f8236b0783506a8e965d8bd2fcc2954aad150b566713701a6541a16bde5e60ebdc9fae986442d3f48e1332f4abb6208f1f7c95bbb8c
-
SSDEEP
12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9T2REnj:mnsJ39LyjbJkQFMhmC+6GD9yREj
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
30fb5b132c6d574c7fdfc74baf3b2abea96d76906375389bccb395351a5d79cfN.exe
Headers
Sections