General
-
Target
2025-01-16_a471854facb61ad4d760001845c57469_darkgate_luca-stealer_magniber
-
Size
9.7MB
-
Sample
250116-x5evksvnft
-
MD5
a471854facb61ad4d760001845c57469
-
SHA1
6275477c5ddfe99db225b580193b6b26e3ae7152
-
SHA256
56bdfa76e1f0629bbde6b7fa28d8efb7e77252ff190b90470078d9a3ab80a15f
-
SHA512
f0e89a7c39a6095be8e932a235ceaba5218fed9cdc1e55af9c92e6b5f6ceb02acf20a616b76eb5515c878d11fa7242d26a589fdb8ef211d1f104e08e861d14f9
-
SSDEEP
196608:zLo73STvxTfg6AiQBhyQbEAkZQdnkW9AVSGfGIJXvaI6HMaJTtGbp:zc73ATfzyyu4JfdJXx
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData
Extracted
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData
Extracted
http://officecdn.microsoft.com/db/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
Extracted
http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
Targets
-
-
Target
2025-01-16_a471854facb61ad4d760001845c57469_darkgate_luca-stealer_magniber
-
Size
9.7MB
-
MD5
a471854facb61ad4d760001845c57469
-
SHA1
6275477c5ddfe99db225b580193b6b26e3ae7152
-
SHA256
56bdfa76e1f0629bbde6b7fa28d8efb7e77252ff190b90470078d9a3ab80a15f
-
SHA512
f0e89a7c39a6095be8e932a235ceaba5218fed9cdc1e55af9c92e6b5f6ceb02acf20a616b76eb5515c878d11fa7242d26a589fdb8ef211d1f104e08e861d14f9
-
SSDEEP
196608:zLo73STvxTfg6AiQBhyQbEAkZQdnkW9AVSGfGIJXvaI6HMaJTtGbp:zc73ATfzyyu4JfdJXx
Score10/10-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Blocklisted process makes network request
-
Suspicious Office macro
Office document equipped with macros.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-