General
-
Target
6280ae0b68beec8b4a402a21b92410ea41d6152991eda16876b35e180d8ba889
-
Size
785KB
-
Sample
241228-c6lpasvlfq
-
MD5
0d801fd2c1976981823db8da4bc98472
-
SHA1
407c3da9b494aa74435f4921a1970f31726948b6
-
SHA256
6280ae0b68beec8b4a402a21b92410ea41d6152991eda16876b35e180d8ba889
-
SHA512
6dd4f842f810cf901d483b8341a52b73190abdf10f5b0ee13ee4fc706030bd824b7c04060c969d0133c808712b7fc423698993826bad0ac37265761c85ae2466
-
SSDEEP
12288:ozbSAXQPC1JhMrFPUIKCqoTI9c2YtxHbQZsgQazBCWJ2bnbBUwYGWAphKrOF81A4:oqnPC9UICqy2YvEs+XJ2zdUwYG4p
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Targets
-
-
Target
局域网快速共享软件.(1).exe
-
Size
1.2MB
-
MD5
d96a9495f22e3ff56aceec12355c78da
-
SHA1
cd908de64f46c099e711047f8c4b6dfc41e42ec5
-
SHA256
9798d671de44f3af36e733e941a9a5319fdf2fb2692fd2e6d0012f9691d1ff60
-
SHA512
3d1291bc2131b00c8071ac59b020fc74114f12afe2312815cef207da89447303a71c74bea9bccf7c9956858458f191a99257673fe6187303f2d08bef8a7ae263
-
SSDEEP
24576:LnsJ39LyjbJkQFMhmC+6GD9OsWLJWzdcwYGLTzU69AD7:LnsHyjtk2MYC5GD4sWLUzdcBiU69AD7
Score10/10-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Adds Run key to start application
-