Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6N.exe

  • Size

    1.8MB

  • Sample

    241231-sgwqzawkez

  • MD5

    7ba7f7a2a3f1f94920da908cbad8a170

  • SHA1

    c54283f9182bbc20442f2142cb76223418914405

  • SHA256

    7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6

  • SHA512

    c284d648345e39edd744986a597687707abb2ad60e9b20671f96e6525360314e8931768321ab783c681263daa665166632e188c07dfa69f6ca3bc623658792c6

  • SSDEEP

    24576:KnsJ39LyjbJkQFMhmC+6GD9hAkHddmSr+FjpsKjlovSPRNQqFi0mTN7:KnsHyjtk2MYC5GDjAqKWKpoWQELmZ7

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6N.exe

    • Size

      1.8MB

    • MD5

      7ba7f7a2a3f1f94920da908cbad8a170

    • SHA1

      c54283f9182bbc20442f2142cb76223418914405

    • SHA256

      7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6

    • SHA512

      c284d648345e39edd744986a597687707abb2ad60e9b20671f96e6525360314e8931768321ab783c681263daa665166632e188c07dfa69f6ca3bc623658792c6

    • SSDEEP

      24576:KnsJ39LyjbJkQFMhmC+6GD9hAkHddmSr+FjpsKjlovSPRNQqFi0mTN7:KnsHyjtk2MYC5GDjAqKWKpoWQELmZ7

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.