Overview

overview

10

Static

static

10

fdebabc866...1N.exe

windows7-x64

10

fdebabc866...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdebabc8667143a1735ac967f807172450141bf8b44a7f72bf08d7874ddd7161N.exe

  • Size

    1011KB

  • Sample

    250121-qd62esvreq

  • MD5

    cbe903f2feabfa1de7ab1b03bfc673e0

  • SHA1

    5834083b53a4ca9ba001a2104e8aed4b3b9869fc

  • SHA256

    fdebabc8667143a1735ac967f807172450141bf8b44a7f72bf08d7874ddd7161

  • SHA512

    b3dbb1f045aac79c4402163e41b407e0cd62125083ec4ae3d213bd86483adcbf2ae376f826dd3c6d83f33392f650172d05ce083e3611f388a1ae63ff30dcb1f4

  • SSDEEP

    12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9u40KgGXFhazmdVgxnG:WnsJ39LyjbJkQFMhmC+6GD9B072aCViG

Score
10/10
xredbackdoorbootkitdiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      fdebabc8667143a1735ac967f807172450141bf8b44a7f72bf08d7874ddd7161N.exe

    • Size

      1011KB

    • MD5

      cbe903f2feabfa1de7ab1b03bfc673e0

    • SHA1

      5834083b53a4ca9ba001a2104e8aed4b3b9869fc

    • SHA256

      fdebabc8667143a1735ac967f807172450141bf8b44a7f72bf08d7874ddd7161

    • SHA512

      b3dbb1f045aac79c4402163e41b407e0cd62125083ec4ae3d213bd86483adcbf2ae376f826dd3c6d83f33392f650172d05ce083e3611f388a1ae63ff30dcb1f4

    • SSDEEP

      12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9u40KgGXFhazmdVgxnG:WnsJ39LyjbJkQFMhmC+6GD9B072aCViG

    Score
    10/10
    xredbackdoorbootkitdiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks