General
-
Target
cea361b3494eded3f64eb3151f7beee1ce67b2e5d08139b2f036503e0278a34e
-
Size
6.9MB
-
Sample
250202-td2ngsylhs
-
MD5
5864a706c06dee9ef8d0d25cd0849230
-
SHA1
815609abf901cf9f41f988d42787b8bcdad39427
-
SHA256
cea361b3494eded3f64eb3151f7beee1ce67b2e5d08139b2f036503e0278a34e
-
SHA512
a5fe08bb5e9353db8faea86a16680565ed3afd70155b12306b106d56d41682a52e20459b859a740b3b16386819d4f857d4c216d79b258baf286c8f333daaf1f9
-
SSDEEP
98304:6URnmaGxt00WLFsEpTKlUo/D8V0jneQlJ4Y1FKBTAB9dBa45cV4tUaabIlaQf:6HL00WLqEpTKD8VeelY7KWZaTKaUlnf
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Targets
-
-
Target
25.1.13（最新）IDM-v6.42.26-Repack.exe
-
Size
7.3MB
-
MD5
464d41cb681ecbaafdd111d87839e4d5
-
SHA1
93510d198831275e56add4e31f0fd2249795db22
-
SHA256
3c2615ac8ae0e64b975a2550bcf478fd806ea35270d5c7f9b022d333b9795cab
-
SHA512
974f5f7cb89a91a448ed6ed309cd00bcdd01b20fe4ed40395d763c40875f9ddbc70e6c57a12e0a0f0b7c8d03a82d685b4357338dceb51c6bb47cde3a5b4846fd
-
SSDEEP
196608:YLKvF5mK03S8fZsTs92Uw41k+NYxO6sBb/5:YmvnF03RfZsIAGkKY0bBbB
Score10/10-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Adds Run key to start application
-