General
-
Target
a07db5ee88458ada018809f1b8cc5b2fc605fc0502d0af51172dcfe870b55be9.exe
-
Size
1.2MB
-
MD5
b8827e4fa6149576aa16cbcf9ff30819
-
SHA1
fc43eee5eff356d8b66cd0e493d990262d1dcc61
-
SHA256
a07db5ee88458ada018809f1b8cc5b2fc605fc0502d0af51172dcfe870b55be9
-
SHA512
975a3e56df9fd37b2fb82211caa7d7271ff067a35f1fab271a26bf34c9c864bac775fa09815c37e591d38db914731cf6fb4309700daa1ae19a43aeb24ae3e65f
-
SSDEEP
24576:TnsJ39LyjbJkQFMhmC+6GD9ANDbqUo5uCMiJ0vH:TnsHyjtk2MYC5GD+Nto5uCAv
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
a07db5ee88458ada018809f1b8cc5b2fc605fc0502d0af51172dcfe870b55be9.exe
Headers
Sections