General

  • Target

    2025-03-08_a86757291ded6071bebdb25260218246_avoslocker_hijackloader_luca-stealer

  • Size

    10.5MB

  • Sample

    250308-zlp8bassgx

  • MD5

    a86757291ded6071bebdb25260218246

  • SHA1

    877122b99cbeaa558e630826a80a72d6397b6b8d

  • SHA256

    172bad26efce11407adfcef7ac35d14506e9cff75fd8644751b12c552a6fe60f

  • SHA512

    91921218c7934ec37d4c695273f8ae670677fec902458507225a09b09f71915a84d794026a378a6cb783f6fed49eb4584ec354ed0affebadb6ab613f99f64bbf

  • SSDEEP

    196608:vNsg4AMgAFNsg4AMgABNsg4AMgAPNsg4AMgA2Nsg4AMgAANsg4AMgA8FIF0wue:vGg4aWGg4aWGg4aMGg4aBGg4anGg4aDe

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      2025-03-08_a86757291ded6071bebdb25260218246_avoslocker_hijackloader_luca-stealer

    • Size

      10.5MB

    • MD5

      a86757291ded6071bebdb25260218246

    • SHA1

      877122b99cbeaa558e630826a80a72d6397b6b8d

    • SHA256

      172bad26efce11407adfcef7ac35d14506e9cff75fd8644751b12c552a6fe60f

    • SHA512

      91921218c7934ec37d4c695273f8ae670677fec902458507225a09b09f71915a84d794026a378a6cb783f6fed49eb4584ec354ed0affebadb6ab613f99f64bbf

    • SSDEEP

      196608:vNsg4AMgAFNsg4AMgABNsg4AMgAPNsg4AMgA2Nsg4AMgAANsg4AMgA8FIF0wue:vGg4aWGg4aWGg4aMGg4aBGg4anGg4aDe

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks