Overview

overview

10

Static

static

10

2025-04-08...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-08_43d120751e6ee8e782df8fcd1568e24e_black-basta_darkgate_hijackloader_luca-stealer

  • Size

    1.8MB

  • Sample

    250408-qz2ntsvms6

  • MD5

    43d120751e6ee8e782df8fcd1568e24e

  • SHA1

    2d665ffb7f67690f307065911b8d2d5bba2e10bc

  • SHA256

    ac636315a87e784b5138f443c9708a4b46eb61bd22a096eef1a3ad1c3abe0b68

  • SHA512

    2d0f49ffd2d097f5c046b00bde63039e6421d1cb93cd852bf211366d1aa65464bdc6e771d7f7ce0d88b9f2319cecab6a72a0ef07cf07a64886747343606a762e

  • SSDEEP

    24576:hnsJ39LyjbJkQFMhmC+6GD9CtqV9KAdvvvuOqwhlstl6z+gnsEt:hnsHyjtk2MYC5GDz/JRvtlstlPSt

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target

      2025-04-08_43d120751e6ee8e782df8fcd1568e24e_black-basta_darkgate_hijackloader_luca-stealer

    • Size

      1.8MB

    • MD5

      43d120751e6ee8e782df8fcd1568e24e

    • SHA1

      2d665ffb7f67690f307065911b8d2d5bba2e10bc

    • SHA256

      ac636315a87e784b5138f443c9708a4b46eb61bd22a096eef1a3ad1c3abe0b68

    • SHA512

      2d0f49ffd2d097f5c046b00bde63039e6421d1cb93cd852bf211366d1aa65464bdc6e771d7f7ce0d88b9f2319cecab6a72a0ef07cf07a64886747343606a762e

    • SSDEEP

      24576:hnsJ39LyjbJkQFMhmC+6GD9CtqV9KAdvvvuOqwhlstl6z+gnsEt:hnsHyjtk2MYC5GDz/JRvtlstlPSt

    Score
    10/10
    xredbackdoordiscoverypersistence

    • Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Xred family

      xred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks