General
-
Target
595a25f9726f8d95d9538a58ef68896edfed76b54b4e8ac872d8ba3e83e9f08b.exe
-
Size
1.8MB
-
MD5
4678a4ea2bf78f0cb7d260064fab8d01
-
SHA1
c725634f47947586fcf4f58b2f64b05270910afe
-
SHA256
595a25f9726f8d95d9538a58ef68896edfed76b54b4e8ac872d8ba3e83e9f08b
-
SHA512
e7dcba3a4c26c0f73577ba3a9908203983263e8c1a6418fd269a07f6898a57a8f7a98267142b3dc29a0054b6a7da51cb2570398f765ca924abf6e17e24945603
-
SSDEEP
49152:xnsHyjtk2MYC5GDccykORxLrRtTn6GuY3:xnsmtk2a9kcrRp6GuY3
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
595a25f9726f8d95d9538a58ef68896edfed76b54b4e8ac872d8ba3e83e9f08b.exe
Headers
Sections