General
-
Target
New Text Document mod.exe.zip
-
Size
392KB
-
MD5
209c2bed74ce311f3de2c3040f5cbd8b
-
SHA1
676dbe2bbf178ca27210c8a2e37aa9652f4e17d5
-
SHA256
672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6
-
SHA512
44b5207ce1a79c220ed014b7803ba4f3b89b0aa81f2232e152da9e5c8004c164a281d8806843a10590e3c55b902ef5e3f359bc117b80b11d052fe60324709324
-
SSDEEP
6144:PiyQGVN3t3bmwUUoI7a+OjFjjGFEduVVZ4vELL2VzCGb49pRYCEheDmDUKUQWCCJ:P/HfRx7aNFXuhTL2I70SmpXCqry
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
New Text Document mod.exe.zip
-
New Text Document mod.exe
Headers
Sections