General
-
Target
file.exe
-
Size
15.0MB
-
MD5
7e33585d157419e39fb4d232c9f0c5dc
-
SHA1
1cf4864a9b009e12534cc299c14466f2b2c9cea3
-
SHA256
027a4baf9864a23fe09d99be3a6f83d1841e47aac2f94d313d2580e84d1b1b39
-
SHA512
3abcb07cdde6d8014149e5ad9c07f1afaa88d4a8fb85a67e6f0514ec613ada145dda81713dd96ba0a91f056d65919820b24c6bf2232d59e7fdc6d27f86b01036
-
SSDEEP
393216:EU5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDvD:v7pttD7yBG/uljIinXj0fX
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
file.exe
Headers
Sections