Overview

overview

10

Static

static

3

2025-01-29...ia.exe

windows7-x64

10

2025-01-29...ia.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-29_f19be4307d4e92b4c63c10769de4fc2b_mafia

  • Size

    6.6MB

  • Sample

    250129-3pp89s1pdp

  • MD5

    f19be4307d4e92b4c63c10769de4fc2b

  • SHA1

    fdda128bf119fd694a8f2a27bb106918b4331f57

  • SHA256

    dc3191c2db33b0d07d84df6ac9cbe42b8fad690baf1cb18d9362eeaa902e4d45

  • SHA512

    11411c200d24282aa8e39e7e365763b1f09706133894544f6d7ce9114c4796946a659bd89c5c14f9d7b1e76b61aaf0cd76fbe26a729dc6b1dfeb256556cdcaf3

  • SSDEEP

    196608:jcvooVgSF3zajKNSPyTcvooVgSF3zajKNSPyqcvooVgSF3zajKNSPy0OrFV:iVHF3PSVHF3P7VHF3PBrFV

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      2025-01-29_f19be4307d4e92b4c63c10769de4fc2b_mafia

    • Size

      6.6MB

    • MD5

      f19be4307d4e92b4c63c10769de4fc2b

    • SHA1

      fdda128bf119fd694a8f2a27bb106918b4331f57

    • SHA256

      dc3191c2db33b0d07d84df6ac9cbe42b8fad690baf1cb18d9362eeaa902e4d45

    • SHA512

      11411c200d24282aa8e39e7e365763b1f09706133894544f6d7ce9114c4796946a659bd89c5c14f9d7b1e76b61aaf0cd76fbe26a729dc6b1dfeb256556cdcaf3

    • SSDEEP

      196608:jcvooVgSF3zajKNSPyTcvooVgSF3zajKNSPyqcvooVgSF3zajKNSPy0OrFV:iVHF3PSVHF3P7VHF3PBrFV

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks