Overview

overview

10

Static

static

10

EagleSpy V5.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EagleSpy V5.exe

  • Size

    1.0MB

  • Sample

    250224-mw5drsyjx9

  • MD5

    bd31c00c6c2064a858d3ae34ea6eadd5

  • SHA1

    bea8299ee2b3c83a1b70f10b6d1ef84442119aed

  • SHA256

    f5d62e00d1051da4f488abedec5b72971c0e7aa629e007390a0130326e1d09ac

  • SHA512

    e84defa02266dc555c8dea236776fd0caa3246b8693163f42f55e3261828f7fbc8b3c713e6e5b7101e0b54b3d1d0c228d589ef464f22a7298cef540340c66efb

  • SSDEEP

    24576:+nsJ39LyjbJkQFMhmC+6GD9Q0P8j/svqAs:+nsHyjtk2MYC5GDzP8j/Mqr

Score
10/10
stormkittyxredbackdoorcollectiondiscoverypersistencespywarestealer

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      EagleSpy V5.exe

    • Size

      1.0MB

    • MD5

      bd31c00c6c2064a858d3ae34ea6eadd5

    • SHA1

      bea8299ee2b3c83a1b70f10b6d1ef84442119aed

    • SHA256

      f5d62e00d1051da4f488abedec5b72971c0e7aa629e007390a0130326e1d09ac

    • SHA512

      e84defa02266dc555c8dea236776fd0caa3246b8693163f42f55e3261828f7fbc8b3c713e6e5b7101e0b54b3d1d0c228d589ef464f22a7298cef540340c66efb

    • SSDEEP

      24576:+nsJ39LyjbJkQFMhmC+6GD9Q0P8j/svqAs:+nsHyjtk2MYC5GDzP8j/Mqr

    Score
    10/10
    stormkittyxredbackdoorcollectiondiscoverypersistencespywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks