Overview

overview

10

Static

static

10

1150fc6830...45.exe

windows7-x64

10

1150fc6830...45.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45.exe

  • Size

    2.1MB

  • Sample

    241231-cmg7rs1qdw

  • MD5

    63a057389438a0b287d32e31149d6ad4

  • SHA1

    f2114dea9d348008317751d413bdf5d4fc047513

  • SHA256

    1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45

  • SHA512

    a2caba5e5e38c282e224a1b381bfa7ce140ab018b118c4fbd224d9444c4380a664131b35b21d05aab5b041683a3095a33b442b288505a75d93989d4a1ddbd096

  • SSDEEP

    49152:hnsHyjtk2MYC5GDfkwkn9IMHealA0Rcj2sdS2CFAaPCSO:hnsmtk2aBdnV94212CRPCt

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45.exe

    • Size

      2.1MB

    • MD5

      63a057389438a0b287d32e31149d6ad4

    • SHA1

      f2114dea9d348008317751d413bdf5d4fc047513

    • SHA256

      1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45

    • SHA512

      a2caba5e5e38c282e224a1b381bfa7ce140ab018b118c4fbd224d9444c4380a664131b35b21d05aab5b041683a3095a33b442b288505a75d93989d4a1ddbd096

    • SSDEEP

      49152:hnsHyjtk2MYC5GDfkwkn9IMHealA0Rcj2sdS2CFAaPCSO:hnsmtk2aBdnV94212CRPCt

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks