Resubmissions

09/03/2025, 22:04

250309-1yxctssqw5 6

09/03/2025, 22:01

250309-1w649asp12 6

09/03/2025, 21:50

250309-1p8dqssnt7 10

09/03/2025, 21:47

250309-1ne1sssmy9 4

General

  • Target

    zirotu.png

  • Size

    2KB

  • Sample

    250309-1p8dqssnt7

  • MD5

    f5c92811b7f5083d0bd5402f3b014737

  • SHA1

    8a1c34741bf13461695ec7838a21ab0d200b82a7

  • SHA256

    7b2f9ebd9a8ef42baa9416c52ceb1fbe1108c894d26a767e25849411ddc9ac00

  • SHA512

    d5ee03187a5ebecb5d3431f74d8a0048fd9a8b38bf06721ebc25986d4a8580b0de32d34a645bdbb271f75674e082e14e223502f879fac18a1edd10598152d247

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      zirotu.png

    • Size

      2KB

    • MD5

      f5c92811b7f5083d0bd5402f3b014737

    • SHA1

      8a1c34741bf13461695ec7838a21ab0d200b82a7

    • SHA256

      7b2f9ebd9a8ef42baa9416c52ceb1fbe1108c894d26a767e25849411ddc9ac00

    • SHA512

      d5ee03187a5ebecb5d3431f74d8a0048fd9a8b38bf06721ebc25986d4a8580b0de32d34a645bdbb271f75674e082e14e223502f879fac18a1edd10598152d247

    • Xred

      Xred is backdoor written in Delphi.

    • Xred family

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks