Overview

overview

10

Static

static

10

Vnhax_new.exe

windows7-x64

10

Vnhax_new.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Vnhax_new.zip

  • Size

    6.5MB

  • Sample

    250105-xmm38ssqaz

  • MD5

    dee2e283a7976ed40aa8edfa92b4b8b9

  • SHA1

    6b5ac41fc668a16c919eeaa5a59351cc695687a0

  • SHA256

    6f513f4b91acba47885d8b61e4da53eb233305956f18be998a5d56048e9c400c

  • SHA512

    802689f5f6924f3f32804d2558783e8447b12bd0c3b16c0ef4edfc79120a7a18bebda41f0f8664abcb01a7ccd61fd27234fe204de2a84c3b67f4e9bddbcee927

  • SSDEEP

    196608:/UV7xz3GIdiu7kKabw95dYJleHm01QGS0:47xbBiXy/C0G0

Score
10/10
xredbackdoordiscoverymacropersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      Vnhax_new.exe

    • Size

      7.0MB

    • MD5

      1cfc313319188c7db6f2e77675101e7a

    • SHA1

      d63cdf56928e870868867032bfb09550f2315dfc

    • SHA256

      3dc0a471eebb84b66dc17e71c00ab6c70541237a870fbba297e3436053c55c66

    • SHA512

      9d250f9d57ca2fd2d2da40f2f505562e5ed5fad502959f50de02053129152a05a86c6b57d50abf40c404b3c95d12ae53fe8612b65e390eb1f01e845d53611997

    • SSDEEP

      196608:HLxlFP7GIFourQ6CJQbHdK3lgz8UXiU/0V:H9lFzJoNi94Uo

    Score
    10/10
    xredbackdoordiscoverymacropersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks