General

  • Target

    26e07468ffa18571a5dabc8c1d319f5234a037801338ed5b6f26eababc96d948

  • Size

    1.1MB

  • Sample

    241218-y3d1ya1nbp

  • MD5

    69ce7be97caf718b1ce238438e8034a7

  • SHA1

    7bbd93ad15be7a0ffa7253afb3c9d3601eecb03c

  • SHA256

    26e07468ffa18571a5dabc8c1d319f5234a037801338ed5b6f26eababc96d948

  • SHA512

    86edfd17cd1569dd9cdb6feaeb6ff51af672ac1c29df1c9c1bf15bf3ec1bc36d311ccb5890877fbe19c48f8882d8ea6696cd67b2a57bec29f9e92a5dc99fc2c0

  • SSDEEP

    24576:xnsJ39LyjbJkQFMhmC+6GD9mYtrkdKzwJgcJH:xnsHyjtk2MYC5GDg3K8JggH

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      26e07468ffa18571a5dabc8c1d319f5234a037801338ed5b6f26eababc96d948

    • Size

      1.1MB

    • MD5

      69ce7be97caf718b1ce238438e8034a7

    • SHA1

      7bbd93ad15be7a0ffa7253afb3c9d3601eecb03c

    • SHA256

      26e07468ffa18571a5dabc8c1d319f5234a037801338ed5b6f26eababc96d948

    • SHA512

      86edfd17cd1569dd9cdb6feaeb6ff51af672ac1c29df1c9c1bf15bf3ec1bc36d311ccb5890877fbe19c48f8882d8ea6696cd67b2a57bec29f9e92a5dc99fc2c0

    • SSDEEP

      24576:xnsJ39LyjbJkQFMhmC+6GD9mYtrkdKzwJgcJH:xnsHyjtk2MYC5GDg3K8JggH

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.