Overview

overview

10

Static

static

10

4beed24364...3N.exe

windows7-x64

10

4beed24364...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe

  • Size

    1.4MB

  • Sample

    250224-nwjbzazrv4

  • MD5

    0eaeabee75f9f0587f6b281f0dba1a40

  • SHA1

    032b248b6466c4b1716c2bbc0fca2d54e151a678

  • SHA256

    4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3

  • SHA512

    77160e900e8f758f5c97081976d4679d06346d8646be316e4a77bce4fad016a38ee6be3b77269fbef85880bd3e7da2d603cc9868fb4c3194e022f723f5c3f848

  • SSDEEP

    24576:cnsJ39LyjbJkQFMhmC+6GD9y4ptpPFR668rjHSzDTYEcyU76BuTD:cnsHyjtk2MYC5GDxpdR6JiS76BGD

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe

    • Size

      1.4MB

    • MD5

      0eaeabee75f9f0587f6b281f0dba1a40

    • SHA1

      032b248b6466c4b1716c2bbc0fca2d54e151a678

    • SHA256

      4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3

    • SHA512

      77160e900e8f758f5c97081976d4679d06346d8646be316e4a77bce4fad016a38ee6be3b77269fbef85880bd3e7da2d603cc9868fb4c3194e022f723f5c3f848

    • SSDEEP

      24576:cnsJ39LyjbJkQFMhmC+6GD9y4ptpPFR668rjHSzDTYEcyU76BuTD:cnsHyjtk2MYC5GDxpdR6JiS76BGD

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks