xred | 7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6 | Triage

Sharing

General

Target

7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6N.exe
Size

1.8MB
Sample

241231-sgwqzawkez
MD5

7ba7f7a2a3f1f94920da908cbad8a170
SHA1

c54283f9182bbc20442f2142cb76223418914405
SHA256

7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6
SHA512

c284d648345e39edd744986a597687707abb2ad60e9b20671f96e6525360314e8931768321ab783c681263daa665166632e188c07dfa69f6ca3bc623658792c6
SSDEEP

24576:KnsJ39LyjbJkQFMhmC+6GD9hAkHddmSr+FjpsKjlovSPRNQqFi0mTN7:KnsHyjtk2MYC5GDjAqKWKpoWQELmZ7

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
xredline1@gmail.com
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  
  7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6N.exe
- Size
  
  1.8MB
- MD5
  
  7ba7f7a2a3f1f94920da908cbad8a170
- SHA1
  
  c54283f9182bbc20442f2142cb76223418914405
- SHA256
  
  7f5496287b11a6db79545591efb3ca02168abab938e17651230210c8eea9baf6
- SHA512
  
  c284d648345e39edd744986a597687707abb2ad60e9b20671f96e6525360314e8931768321ab783c681263daa665166632e188c07dfa69f6ca3bc623658792c6
- SSDEEP
  
  24576:KnsJ39LyjbJkQFMhmC+6GD9hAkHddmSr+FjpsKjlovSPRNQqFi0mTN7:KnsHyjtk2MYC5GDjAqKWKpoWQELmZ7
Score

10^/10

xred backdoor discovery persistence
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xredbackdoordiscoverypersistence

behavioral2

xredbackdoordiscoverypersistence