Overview

overview

10

Static

static

1

Cracking Tools.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cracking Tools.rar

  • Size

    106.6MB

  • Sample

    250110-lny2cazrd1

  • MD5

    c585ea080095642f32e6a684146cbe86

  • SHA1

    3312d31d90b86fe4a8f9a4c79d50e37811110491

  • SHA256

    2133ac409362b4b0c40c025196029ec2424c916f79c6265fcef6e450db8184e9

  • SHA512

    32b5fd63f1397fa6b6fabd0a3f533f4f3bbb1e77193cfcb6380262fb88b0138e97fc8a3e38f89e882d7013cf958d26bc2e766c28fe1ca9cf3c7db3ca06d1caaa

  • SSDEEP

    3145728:ownRC8LPyiedFSAU34D1fEC9PcF0z3ao5hGYZ:FLyiOFSAU34D17VcGz3aShZ

Score
10/10
xredbackdoordiscoverypersistencepyinstaller

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      Cracking Tools.rar

    • Size

      106.6MB

    • MD5

      c585ea080095642f32e6a684146cbe86

    • SHA1

      3312d31d90b86fe4a8f9a4c79d50e37811110491

    • SHA256

      2133ac409362b4b0c40c025196029ec2424c916f79c6265fcef6e450db8184e9

    • SHA512

      32b5fd63f1397fa6b6fabd0a3f533f4f3bbb1e77193cfcb6380262fb88b0138e97fc8a3e38f89e882d7013cf958d26bc2e766c28fe1ca9cf3c7db3ca06d1caaa

    • SSDEEP

      3145728:ownRC8LPyiedFSAU34D1fEC9PcF0z3ao5hGYZ:FLyiOFSAU34D17VcGz3aShZ

    Score
    10/10
    xredbackdoordiscoverypersistencepyinstaller

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks