General
-
Target
d4dd7f9d6e297e1e2bc8d1a6a22d42b96713c368eac0a23ae430f0f33b146bebN.exe
-
Size
1.1MB
-
MD5
332f4cb497d383a19d37744cc7e22e00
-
SHA1
00925011527b79967c2b8487d4de46d6033512e9
-
SHA256
d4dd7f9d6e297e1e2bc8d1a6a22d42b96713c368eac0a23ae430f0f33b146beb
-
SHA512
4bc07352cfa3829f6f2b9810149a16b12b8353aeb3b21f5809a1aa5d0ce53d04ed11b738fef02ae2b64a6ca1576e15edd7639049219a6373ea8ea36f3fc92025
-
SSDEEP
12288:tMSApJVYG5lDLyjsb0eOzkv4R7Qnvt35+6G75V9FxKewO79X+27RAlJx8Eport9:tnsJ39LyjbJkQFMn+6GD93AlJx8Eporr
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
d4dd7f9d6e297e1e2bc8d1a6a22d42b96713c368eac0a23ae430f0f33b146bebN.exe
Headers
Sections