Overview

overview

10

Static

static

10

adf64abb40...43.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adf64abb408b1eaac3668e8b5d984780ce5664e8cc1579a0bebf1380cba23d43.zip

  • Size

    390KB

  • Sample

    250202-wxhqtsvrhk

  • MD5

    17169e60bdd536e608f7ee3647d7cbf8

  • SHA1

    4101787bcfc5bdb137eed0e9e5961dda63db305d

  • SHA256

    5d9f409feaadc0e3b7d36aa8c3987ca70104e172b65faf8ab252d57a7d3dc273

  • SHA512

    9007ed90910b1ee56e857f99910f7b54bd93092337ab735c29e32293254f485ff3480e87aab876b00975576728e23b85ff2d05331d726866896f619117cf3e34

  • SSDEEP

    12288:fO0ROTy8jyX1uT82lwu5TPlnNe3oVD2+QQz6W0:ff6jSgYZu55fuQb0

Score
10/10
xredbackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      adf64abb408b1eaac3668e8b5d984780ce5664e8cc1579a0bebf1380cba23d43.exe

    • Size

      760KB

    • MD5

      79549e64dc118988e997a209ef99567d

    • SHA1

      48948a955e0266ac2d5fb7c61e3f48aca97a829c

    • SHA256

      adf64abb408b1eaac3668e8b5d984780ce5664e8cc1579a0bebf1380cba23d43

    • SHA512

      3c58de1340c4a68509cc5c72b6eddc91ffca7d0d0038363632bd6abd51a165452e0a1d2bf0ecbffa0a1ec4e0e9a2f421deaae681f81373917d9dee72c283e4ea

    • SSDEEP

      12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9KmKj:WnsJ39LyjbJkQFMhmC+6GD9c

    Score
    10/10
    xredbackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalation
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks