Overview

overview

10

Static

static

10

831404d4e3...2f.exe

windows7-x64

10

831404d4e3...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    831404d4e34a7688fc270ecc4c0a90cb983cdb646526620aed133e7208b3b32f.exe

  • Size

    2.0MB

  • Sample

    250102-fnbcdsvjhz

  • MD5

    79064fada9076b06ada36e43bec8b2f3

  • SHA1

    e2a5e7736a7e34e2d01413063415a037398e3363

  • SHA256

    831404d4e34a7688fc270ecc4c0a90cb983cdb646526620aed133e7208b3b32f

  • SHA512

    243b0f085c1147a092ef4a93db3b614e9f875af248468ec5011de8371b1800d6fcefc0cac8932a729e384958fcc2c4592a48c0906cf372aaeee167b6a9d59bdd

  • SSDEEP

    24576:HnsJ39LyjbJkQFMhmC+6GD9nU5fyz/pn/yYvbdtYqscmiiigiMO0PJNTw+Tcs48:HnsHyjtk2MYC5GD1UNyJzghOGTZTcv8

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      831404d4e34a7688fc270ecc4c0a90cb983cdb646526620aed133e7208b3b32f.exe

    • Size

      2.0MB

    • MD5

      79064fada9076b06ada36e43bec8b2f3

    • SHA1

      e2a5e7736a7e34e2d01413063415a037398e3363

    • SHA256

      831404d4e34a7688fc270ecc4c0a90cb983cdb646526620aed133e7208b3b32f

    • SHA512

      243b0f085c1147a092ef4a93db3b614e9f875af248468ec5011de8371b1800d6fcefc0cac8932a729e384958fcc2c4592a48c0906cf372aaeee167b6a9d59bdd

    • SSDEEP

      24576:HnsJ39LyjbJkQFMhmC+6GD9nU5fyz/pn/yYvbdtYqscmiiigiMO0PJNTw+Tcs48:HnsHyjtk2MYC5GD1UNyJzghOGTZTcv8

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks