General
-
Target
RUNMEFIRST.exe
-
Size
25.0MB
-
MD5
702fe0f78a8710721d8b2e19b9eacffd
-
SHA1
526188c754dbbabf43b1b33a37578496a5b5e859
-
SHA256
c5a2b12a61b5e60516640b7a465013bce5507dbfb84269775ca899ebb1fde6ac
-
SHA512
c14623467ce8c4ab857f3239d29780c58daea9f866f124f6adb5013738411841d250c94141908e96d466fe866372706696eac9d8493ec6ba72af771d7ad20927
-
SSDEEP
786432:mrp+Ty2SfUfnbu+zMFy/7zYgWXRLTArzttOaaFL:ap+Ty2SfWnPzMFO7zYgWBLbFL
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
RUNMEFIRST.exe
Headers
Sections