General
-
Target
33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
-
Size
2.0MB
-
MD5
214b89daf10eac599849585b0cdcc17f
-
SHA1
130d23e90e1664d1de99064085a967622fd30163
-
SHA256
33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc
-
SHA512
b2209e3dd612cc933f204ca0825d4467667b1e208a0a45c8f4d9a4ab88b0b94967a12cc9b0a4b7c658c1e826a0dbdb2b322e83e92949c63260291cef0293a38b
-
SSDEEP
49152:XnsHyjtk2MYC5GDgvRlyycuEU7NyZ7JOyra/uN4c:Xnsmtk2aXy1uEU7Nu7JOyUu
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
Headers
Sections