Overview

overview

10

Static

static

10

rel/X_ATTA....9.exe

windows10-ltsc 2021-x64

10

rel/data/Cloner.py

windows10-ltsc 2021-x64

3

rel/data/Main.bat

windows10-ltsc 2021-x64

8

rel/data/Xprocess.exe

windows10-ltsc 2021-x64

7

rel/data/boot.bat

windows10-ltsc 2021-x64

1

rel/data/bootdis.exe

windows10-ltsc 2021-x64

7

rel/data/copy.bat

windows10-ltsc 2021-x64

7

rel/data/c...py.exe

windows10-ltsc 2021-x64

7

rel/data/ddos.exe

windows10-ltsc 2021-x64

1

rel/data/emoji.py

windows10-ltsc 2021-x64

3

rel/data/fixpy.bat

windows10-ltsc 2021-x64

1

rel/data/i...on.bat

windows10-ltsc 2021-x64

8

rel/data/joiner.py

windows10-ltsc 2021-x64

3

rel/data/sms.exe

windows10-ltsc 2021-x64

10

rel/data/tc.py

windows10-ltsc 2021-x64

3

rel/data/wbspam.exe

windows10-ltsc 2021-x64

7

rel/fix.bat

windows10-ltsc 2021-x64

1

rel/token.bat

windows10-ltsc 2021-x64

7

rel/token2.bat

windows10-ltsc 2021-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rel.rar

  • Size

    80.3MB

  • MD5

    2632f76723ccf7569742043990866f2f

  • SHA1

    9f264bdd05547bbc6c59f892dc03153359e281f1

  • SHA256

    c62bf66fbefa93ed91e76e92d0ac1f46a1307260f07dbc4f8da2dc1d9d9ed1e0

  • SHA512

    aa3fa3525d3c6fc35acecdf39f482fdc92f23904d70c616cf1c9782e3758a81a6cb862f3f20cbc3775149d376c690ed7e7bd6b17d5d41fa97a7fe0b05c27c226

  • SSDEEP

    1572864:eL7++F3anj7+orhFvyzTeE4xCVx10pQPEUifLdi0aoH6JqAe4yPnWd1GxvIunn:eu+IjyorhFvyzCE4cPsUJyaPyPWd18v5

Score
10/10
pyinstallerxred

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred family
    xred
  • Detects Pyinstaller 4 IoCs
    pyinstaller
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • rel.rar
    .rar

    Password: X

  • rel/X_ATTACKER-V5.9.exe
    .exe windows:4 windows x86 arch:x86

    Password: X

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • rel/data/Cloner.py
  • rel/data/Main.bat
  • rel/data/Xprocess.exe
    .exe windows:5 windows x64 arch:x64

    Password: X

    5bc16b5845145eb0edb88983820691b1


    Headers

    Imports

    Sections

  • x.pyc
  • rel/data/boot.bat
  • rel/data/bootdis.exe
    .exe windows:5 windows x64 arch:x64

    Password: X

    023abd09c65289e3a2df4aa2b19cccec


    Headers

    Imports

    Sections

  • bootdis.pyc
  • rel/data/copy.bat
  • rel/data/copy/copy.exe
    .exe windows:5 windows x64 arch:x64

    Password: X

    023abd09c65289e3a2df4aa2b19cccec


    Headers

    Imports

    Sections

  • copy.pyc
  • rel/data/data/tokens.txt
  • rel/data/ddos.exe
    .exe windows:4 windows x64 arch:x64

    Password: X

    1c2a6fbef41572f4c9ce8acb5a63cde7


    Headers

    Imports

    Sections

  • rel/data/emoji.py
  • rel/data/fixpy.bat
  • rel/data/install-python.bat
    .bat .vbs
  • rel/data/joiner.py
  • rel/data/logo.gif
    .gif
  • rel/data/proxy.txt
  • rel/data/sms.exe
    .exe windows:4 windows x86 arch:x86

    Password: X


    Headers

    Sections

  • rel/data/tc.py
  • rel/data/tokens.txt
  • rel/data/wbspam.exe
    .exe windows:5 windows x64 arch:x64

    Password: X

    023abd09c65289e3a2df4aa2b19cccec


    Headers

    Imports

    Sections

  • s.pyc
  • rel/fix.bat
  • rel/token.bat
  • rel/token2.bat
  • rel/อ่านๆ.txt