Overview

overview

10

Static

static

10

Dork_Searc...ol.exe

windows10-2004-x64

10

Dork_Searc...te.dll

windows10-2004-x64

1

Dork_Searc...op.dll

windows10-2004-x64

1

Dork_Searc...op.dll

windows10-2004-x64

3

Dork_Searc...et.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dork_Searcher_v3.zip

  • Size

    2.2MB

  • MD5

    f2094ab0ffe06124e836beba8b1af312

  • SHA1

    86f98c7cac38bef4071078f4cf44772ed3472e6f

  • SHA256

    e26627bf50ef412d0a549da70f297c978ed8ec4d6bd5883897fd02aeae500ae9

  • SHA512

    3f30543f5e562a0a581c6fee76bbe24b3e7220e34e37e11689bae02dc32e9d78541a2c1eef7662a25d712ea00a37a645aeddc03bf79c791c82f852ec96286c0e

  • SSDEEP

    49152:bfHw+J4rZgwiAEk0lei79jMxz/6POxVpZ0HRbah9kfTPQTO+/4+Sg:8+J4d0fk0ki79IxLU4X0HRbHPQTAw

Score
10/10
stormkittyxred

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xred family
    xred
  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • Dork_Searcher_v3.zip
    .zip

    Password: 1

  • Dork_Searcher_v3/AntiPublic/link.db
  • Dork_Searcher_v3/Dork Searcher v3 tool.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1


    Headers

    Sections

  • Dork_Searcher_v3/System.Data.SQLite.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Dork_Searcher_v3/x64/SQLite.Interop.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1

    dfe93356a5a3a0b9440e3c9a6059e32d


    Headers

    Imports

    Exports

    Sections

  • Dork_Searcher_v3/x86/SQLite.Interop.dll
    .dll windows:6 windows x86 arch:x86

    Password: 1

    5aa1a11a133cd3f1269809855262840f


    Headers

    Imports

    Exports

    Sections

  • Dork_Searcher_v3/xNet.dll
    .dll windows:4 windows x86 arch:x86

    Password: 1

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections