Overview

overview

10

Static

static

10

plugu v1 fixed.dll

windows7-x64

1

plugu v1 fixed.dll

windows10-2004-x64

1

影子注入器.exe

windows7-x64

10

影子注入器.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    159bd973bae27b814a3e532b2ffe7d3960b96c1f739a2967c7ce8f77c6954521

  • Size

    5.9MB

  • Sample

    241226-q496rsxlfk

  • MD5

    0165434eb4f7ee770a13aa1fb3cba927

  • SHA1

    2246e47bf235fd53b65c99f1227cd69ca33d6ce2

  • SHA256

    159bd973bae27b814a3e532b2ffe7d3960b96c1f739a2967c7ce8f77c6954521

  • SHA512

    c29ef62b12bbecfbb9afc11f95358cde48d494859e6b3edbd65098c27a046a19ca0d75b66dcd362195d3bafb5068e52d8de11c3b9c4f90a59cc8a88941d56935

  • SSDEEP

    98304:DvfBhQnavuXxkGUYW65edmYHoomSWVhL6BIPRCuae3aNWQRwGnt0UH+LzvP9Hvp:DXizxkiW65GIu+AgRyRwYt5OX

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      plugu v1 fixed.dll

    • Size

      8.5MB

    • MD5

      99492d91112af8d998d0861aab3acabb

    • SHA1

      ea514ae666eebf3dd02337cd55531c36407bbf18

    • SHA256

      f2ecabc649b7db40d38a85bbdb8e4491adb613d242bbda3be3677975820d7268

    • SHA512

      fb2a530a0cb47ca7cd814ed7b9887f4232458b918ef99a27238b54ad1ba91ea8f37fcb4c2318bf769aa5f5d22b796f6993bd6203c187969222b1d03a4282a296

    • SSDEEP

      49152:I03qQXG9X3tDkajE3OtgaNBsp5xYeRY+yvBbixY+6hOEuJgh/6RgjbwimjnE47/H:Qb98pshUih/nbwcgKRlRT7qFx15jXzH

    Score
    1/10
    behavioral1behavioral2

    • Target

      影子注入器.exe

    • Size

      4.0MB

    • MD5

      a3394afcebb8ce03f9e9c3c5d8184ef2

    • SHA1

      45047fe83b6090d673d79784f21d8e36bc737e3b

    • SHA256

      cc1bd1fbd03e5961d31cc39f112cf061412aaaca2f6b17ef2eb9263ac5a4a6f9

    • SHA512

      d1c69a4bf85d6f46c8cab27d85095e61b9ea3188a4376ad0b849371f4d485f374ce3cc3fa2c9320854503ea6d56ac8bf13abda06a505ee428199a40331aeb69e

    • SSDEEP

      49152:3nsHyjtk2MYC5GD3YREXSVMDi3ayyyoyGyfQKmHm1:3nsmtk2ar2SVMD8ZybA

    Score
    10/10
    xredbackdoordiscoverypersistence
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks