General
-
Target
c24ac669ab1e4689d70f416cdff3ea0ec4c9856e324f5eafc27c4ce32fa91b0f.exe
-
Size
1.6MB
-
MD5
812a0aea3929e99d479e0f6c96c7efdf
-
SHA1
7337af6d58c1ab32cff259e1f794ded2e8710910
-
SHA256
c24ac669ab1e4689d70f416cdff3ea0ec4c9856e324f5eafc27c4ce32fa91b0f
-
SHA512
35a5f702277ab7fc7edf257a4c310d430440e68c724510d264247be82f49a435fc30b4861fb242e4497ed596e65e3fea50de1642c02b78d6bac4dec08e0e965d
-
SSDEEP
49152:snsHyjtk2MYC5GD7Zkg6Yf5/pFFFOhKMdDBY:snsmtk2acZkg6YBhFFFOhKMdy
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
c24ac669ab1e4689d70f416cdff3ea0ec4c9856e324f5eafc27c4ce32fa91b0f.exe
Headers
Sections