Overview

overview

10

Static

static

10

bc24fa45f5...06.exe

windows7-x64

10

bc24fa45f5...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc24fa45f522637e923c1e64346be2a9b0d02f64a1beeed3a0e70170ddea0206

  • Size

    1.1MB

  • Sample

    250221-grjnlsvpfp

  • MD5

    2168efe511da4705864cc5ddef26edd1

  • SHA1

    d934033eb8f74c47e69063d13574bf571a19ee2e

  • SHA256

    bc24fa45f522637e923c1e64346be2a9b0d02f64a1beeed3a0e70170ddea0206

  • SHA512

    a3d23b94a8f0620c1ed0d1ed3529794ad2ae6909de5f0b9c79eb33af47a47d3f562d107e7e70dc7cef7ba4a8b27b76669e1679fefec3d12f1cc4db4cfa66ac2d

  • SSDEEP

    24576:iap2f3ptaCOa6hw+6GD9kuu1OUjezCk4o5BSj17Qd:ufaC76hw5GDauukUjez+PpQd

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      bc24fa45f522637e923c1e64346be2a9b0d02f64a1beeed3a0e70170ddea0206

    • Size

      1.1MB

    • MD5

      2168efe511da4705864cc5ddef26edd1

    • SHA1

      d934033eb8f74c47e69063d13574bf571a19ee2e

    • SHA256

      bc24fa45f522637e923c1e64346be2a9b0d02f64a1beeed3a0e70170ddea0206

    • SHA512

      a3d23b94a8f0620c1ed0d1ed3529794ad2ae6909de5f0b9c79eb33af47a47d3f562d107e7e70dc7cef7ba4a8b27b76669e1679fefec3d12f1cc4db4cfa66ac2d

    • SSDEEP

      24576:iap2f3ptaCOa6hw+6GD9kuu1OUjezCk4o5BSj17Qd:ufaC76hw5GDauukUjez+PpQd

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks