xred

General

Target

DOCUMENTZ.zip
Size

1.2MB
Sample

241230-mgjthsvkbj
MD5

c2c9a9190ea691fb502a99855dadb789
SHA1

cffcc6d360d5ce539c2f8221cb1a6adb2c468bc6
SHA256

4c939e53a7c2c5b619a63ab6d028d0925d49ecb056f44205dbc27a0045981cd2
SHA512

76983c12cd2f98f4c21e637df1c2bac63027a599fd3647dad9d78abc36f0eb14a3b9d20b02ebaf50c3d90be2f31c18b6badbc537ce7f2c1be551a8fba282b33e
SSDEEP

24576:KSx32nMHd/xfRzr2ZPE/jC695RFgZH/3tlu8SQWOa3u3nc2G40zCsXiG:3FttVZR2Z/tKTMn3G4gC0iG

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  
  PURCHASE ORDER DOCUMENT/Purchase Order Summary Details.vbs
- Size
  
  664B
- MD5
  
  f86e6209572e4aa47973b354ce16342f
- SHA1
  
  651a612eb8b23c243341710deafe8b8032aabf09
- SHA256
  
  b5dcbbec05c4132e2221ee1be9a68d1ef4b0772a8568eab50f52ecbccca2c30d
- SHA512
  
  f66d205ab4f9db97bc51aecff2e05f07701bcb5b63c15702362eb526328461306ef166c8339d571124a0a744ad9f8b24fc0f60872f8832a4ed57df92559957b7
Score

10^/10

xred backdoor discovery persistence upx
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  PURCHASE ORDER DOCUMENT/Supplier 0202AW-PER2 Sheet.exe
- Size
  
  1.6MB
- MD5
  
  97e5ba8188b0e2613fd02ee2b8dfee7a
- SHA1
  
  17e314b66392d3d14e68f3e4a0ce4e3649255835
- SHA256
  
  2d976b78efe5c7e983ff4cef98deb25d21a901e8f954f6d915d5642e75420296
- SHA512
  
  dbb0c03170d807be5e43deb0fd7f1198bb56606cd4bb65d3ccb00b19759336f84c49072baedc6e674db308f58618f58e7d6de24fcb12c7f951de04e7e9c76e1f
- SSDEEP
  
  24576:MnsJ39LyjbJkQFMhmC+6GD9nhloDX0XOf4Z79H8qN3k87zwVb2UDEusw:MnsHyjtk2MYC5GD5hloJf68qIyUDEuL
Score

10^/10

xred backdoor discovery persistence upx
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4