General
-
Target
35f873a09d5330e0c8c0e0bdabac9640e606ac7955b6e2082d9d1ca3d9880492.exe
-
Size
1.6MB
-
MD5
31ba582dde7c48214dfc929a8c5d5662
-
SHA1
39497422641176cb4b6f8828b43805cbd1258d53
-
SHA256
35f873a09d5330e0c8c0e0bdabac9640e606ac7955b6e2082d9d1ca3d9880492
-
SHA512
1357ffa717079a422ac2510f010722ec464c1f595fbba3a1df847ff3370f30d5b6adb393f846838c565de7b669c6e0968236c6ed8ce079da3281531373aa849e
-
SSDEEP
24576:snsJ39LyjbJkQFMhmC+6GD9ChloDX0XOf4f/mlhxQfnmrAL4bHpZlF:snsHyjtk2MYC5GD4hloJfY/mlT/rLL
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
35f873a09d5330e0c8c0e0bdabac9640e606ac7955b6e2082d9d1ca3d9880492.exe
Headers
Sections