General
-
Target
2025-04-09_afe6ccbb1c1a42e0a221b1c087c90cd9_black-basta_darkgate_elex_luca-stealer
-
Size
1.1MB
-
MD5
afe6ccbb1c1a42e0a221b1c087c90cd9
-
SHA1
8d99f8057631b841b3aa168dd84a061508675839
-
SHA256
611a4b35ee8dbe0bf79b6f1cc6a5f444b6fa0c6fd19c91d18132f7024f3632b8
-
SHA512
1d48ede671e38267d949b6d196482867557c657d39fc87de872db1fa2b23892a50a8175a1b8154367cf666000822906c88971f10e22db5c269eddba6094fcc43
-
SSDEEP
24576:dnsJ39LyjbJkQFMhmC+6GD9/AlJx8Eporn:dnsHyjtk2MYC5GDRMCEOrn
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2025-04-09_afe6ccbb1c1a42e0a221b1c087c90cd9_black-basta_darkgate_elex_luca-stealer
Headers
Sections