Overview

overview

10

Static

static

10

81d37764ce...d2.exe

windows7-x64

10

81d37764ce...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81d37764ce48e1f76d1de50ee831094117ffc239e287e40806801dd0bba097d2.exe

  • Size

    771KB

  • Sample

    250116-djl7zsykhz

  • MD5

    beaa68e5cc534b255a5a7f50580fc92a

  • SHA1

    1f0278d90302bd11a53366bdb78fa353b4b1ea58

  • SHA256

    81d37764ce48e1f76d1de50ee831094117ffc239e287e40806801dd0bba097d2

  • SHA512

    ee4a23a968a461032212dea9d3d7102a948034f9c6e733f83e26a9382cb372cb8d9484c2785b548111440ad86086107b615d209611bc6c4dd135bd87968d77a7

  • SSDEEP

    12288:iMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Us:insJ39LyjbJkQFMhmC+6GD9T

Score
10/10
njratxredbackdoordiscoverymacropersistencetrojan

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      81d37764ce48e1f76d1de50ee831094117ffc239e287e40806801dd0bba097d2.exe

    • Size

      771KB

    • MD5

      beaa68e5cc534b255a5a7f50580fc92a

    • SHA1

      1f0278d90302bd11a53366bdb78fa353b4b1ea58

    • SHA256

      81d37764ce48e1f76d1de50ee831094117ffc239e287e40806801dd0bba097d2

    • SHA512

      ee4a23a968a461032212dea9d3d7102a948034f9c6e733f83e26a9382cb372cb8d9484c2785b548111440ad86086107b615d209611bc6c4dd135bd87968d77a7

    • SSDEEP

      12288:iMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Us:insJ39LyjbJkQFMhmC+6GD9T

    Score
    10/10
    njratxredbackdoordiscoverymacropersistencetrojan

    • Njrat family

      njrat

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks