General
-
Target
36d8639d25e4f278cad84fff5e26bcf90ae48085da4c47921b7d14d3b1f8752dN.exe
-
Size
1.1MB
-
MD5
7bc23167b8068c614335900a13489920
-
SHA1
4099816725b79c0ed69634e326538c412b23c277
-
SHA256
36d8639d25e4f278cad84fff5e26bcf90ae48085da4c47921b7d14d3b1f8752d
-
SHA512
11bd51195220d88de0458cd81f34ca97b826e32bc64ed91d5c5891aabfbf72c0074409e5f6e95d8f2a57b3609956570dedf9214e3d5a3bd5606f66b9be328a66
-
SSDEEP
24576:onsJ39LyjbJkQFMhmC+6GD9epcBi1nyvtouxU7:onsHyjtk2MYC5GDkr1n+t1xU7
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
36d8639d25e4f278cad84fff5e26bcf90ae48085da4c47921b7d14d3b1f8752dN.exe
Headers
Sections