General
-
Target
god-potato.exe
-
Size
814KB
-
MD5
d85e84021532b8a1724f013672c7964c
-
SHA1
9802561c9f4dd85dc2b7e2b19da3b27096a96ab6
-
SHA256
1b92eb0299c15c1edf9a381c2480d29de3fd928337972dd645d66003c5d78604
-
SHA512
5ac00504fe244f13158f5c5c01c4c0e15f653f2befb2af86e31e7efb8cc4bbe3bd7af50637db926ac83b86dcb17c1fcb12fa4ff43c13f9a86e0f4348effc18a0
-
SSDEEP
12288:NMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9tfLO4LNzu:NnsJ39LyjbJkQFMhmC+6GD9tLI
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
god-potato.exe
Headers
Sections