Overview

overview

10

Static

static

10

Zara+Perm_...ky.exe

windows7-x64

3

Zara+Perm_...ky.exe

windows10-2004-x64

4

Zara+Perm_...ms.dll

windows7-x64

1

Zara+Perm_...ms.dll

windows10-2004-x64

1

Zara+Perm_...I2.dll

windows7-x64

1

Zara+Perm_...I2.dll

windows10-2004-x64

1

Zara+Perm_...ky.exe

windows7-x64

10

Zara+Perm_...ky.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zara+Perm_new_fix.rar

  • Size

    1.4MB

  • Sample

    250207-r66rssvndw

  • MD5

    c03d02758decb833511d5eca2199b2ba

  • SHA1

    d65a038232ffeb5884f4c9940c5f345439c55426

  • SHA256

    88bafacc1986b26f289c4fbeb2c8dd22d11b1c7eb425e2776f0cecec9bf7103c

  • SHA512

    0c81253add6e840ef97476d5674a7caf6251a87d14827403176697e98c9e1127b035d106c8a9c5a7f0d00c8e5d559242ca01f91290c3e1fb1ca4a2143c8b7e63

  • SSDEEP

    24576:5x/2SQPwlQd+YyB97DigmGOzDrHzUYvlksRWGgSpsnnpEoykQxjr8Lx21CcUy:5x/n6wlQ4YyB9xm/zDrTUwjzNpueosrL

Score
10/10
xredbackdoordiscoverymacropersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      Zara+Perm_new_fix/._cache_Lucky.exe

    • Size

      73KB

    • MD5

      bda7e3ae3b6d42fd2ae7fc727ed53cd7

    • SHA1

      6c43aad175ab5754ea0aecede688c5ae87f946ba

    • SHA256

      2c54752c7dfc19485fa1e2f5193de64a74d61bcc485ffa33df95bff2b5fd8285

    • SHA512

      b9a11e2aba64bf29452010bde4035f3b3196b32da82392f60d56c76b133ca574fdfe51d0e1ba342e5678c9e403323fb292ee51523eb1637d13a1077134036722

    • SSDEEP

      1536:xRQT4CM+vza9t1LTtlbeK2Iu3wNsS8W/1WDkB8l/qfWO:3QsDSO9fLTLbeK2ISwSHy1WDkBSgWO

    Score
    4/10
    discovery
    behavioral1behavioral2

    • Target

      Zara+Perm_new_fix/Bunifu.UI.WinForms.dll

    • Size

      1.3MB

    • MD5

      7bbf428fb683748a73594b9791a39f96

    • SHA1

      341d30a12cbbd2e8c654fb1ddc382017ac83b2c2

    • SHA256

      a870923034e7f135a4e34a3192c39fea8bf2f8f6a82e700b547101245e5f9de9

    • SHA512

      1770ee20d88f83cfe343800a4dbc95eff0c9c253e2f42cd4d52baac959e1c8385c1c208610b10eeb96782283010ecc36d51ecce9bb815d3ee480024936327c58

    • SSDEEP

      12288:FGixaz9472cwOIqgDGKyB0s2nCgtXcMrtObY18mdXQPGdc/Cs7R9LVyoasofOMKs:FFGdc/r/LjedWVhHc5zmr+udY/VrJ

    Score
    1/10
    behavioral3behavioral4

    • Target

      Zara+Perm_new_fix/Guna.UI2.dll

    • Size

      2.1MB

    • MD5

      278752062981db6fe27ba55f5099b8ae

    • SHA1

      8446637986cf4a24e9135ee5c54f3170600e1e83

    • SHA256

      538e6ca6001d609e251f88243409a2cbc9bc0517751843e76485a2c335e7829b

    • SHA512

      142ff82ca90ca63a6a854e866615d742b585c102e8c4de5c773edeb1ac30c2cc2f6bcb190da394e4aadb4ef9518d194d99904463d6e952170d2924b16fcb00a5

    • SSDEEP

      49152:PQNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckFjvkoEFB:PAhck1

    Score
    1/10
    behavioral5behavioral6

    • Target

      Zara+Perm_new_fix/Lucky.exe

    • Size

      827KB

    • MD5

      bd5b0d0e0d77e04b61310bc0acc12d84

    • SHA1

      219d4315e4e548a96ecf0b79d3a1e9d1c0a54c2f

    • SHA256

      06b0e5ab2523ee4fc585d3464a996de274d26a802eb64b8d04cef84d088f54c6

    • SHA512

      217d8877a15d11b8cb5606aeecc63fa9f99d5882abe9b6ed26900e8d530348387639a8fa428a6942f15313daafc42b4c400550b2e588a66cd157e2fde51dce59

    • SSDEEP

      12288:JMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9hHV9+qSsWGj:JnsJ39LyjbJkQFMhmC+6GD9B

    Score
    10/10
    xredbackdoordiscoverymacropersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks