xred | 07253ef5773f341575fac2b249ff1f59fbba52c0340639e68f9f28ea959a40d1

Sharing

Copy URL Twitter E-mail

General

Target
07253ef5773f341575fac2b249ff1f59fbba52c0340639e68f9f28ea959a40d1
Size 13.7MB
Sample260415-e55f5ah171
SHA256 07253ef5773f341575fac2b249ff1f59fbba52c0340639e68f9f28ea959a40d1
MD5 b9967c6f96bf5f75bdaae5fb22272e3b
SHA1 e8616e327be8751dc4f140a9c2ae2b7d2c837bdb
SHA512 0d1aa6f180b79718645b9d1844490a28d23a58bd0fead5e95b841bf81c5e8e8e5c1c6c0d7e14af5bb52d7b70c4347b999a816c407d237379604d6fafe8de051a
SSDEEP 393216:f+DUL4FeRxz48D7CG1uKT0RMnbd8d+rABd3mPcSzawO:fUUHRxzfrUMPbac4m2
TLSH
T134E612345E1BACB1D1EB99274B74800C490082C7B3F0F76686E58DA639957FE9CC626F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  X-Scan-v3.3/._cache_xscan_gui.exe
- Size 1.7MB
- SHA256 1c2e4984aeb420f9e7af69f8c941ecf5226b70644d43e98963be47dbb88c4f7f
- MD5 686dc3e581e47d8f86d26029787129e8
- SHA1 a9e900510396192eb2ba4fb7b0ef786513f9b5ab
- SHA512 73403160d9e6fd88031cc380a024181978ef3afb336e2d2805c9c3bcf12dc00806917d124ed461be15b9f3750fadfb7e7a2a5e19e141f2db789f04c7dbe482c3
- SSDEEP 24576:Yj3CC5gCLAZxROt5HdUnWtLZly1PRRc2HWFxPUSMUBEXBrNZu83HGyPwR:YjRttLZlyjRRWnPUU4Hr
- TLSH
  T180854A31F501C83BD47326759C5BA2E96829F7982A11980B2F686E4CBFB57C23D03E57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  X-Scan-v3.3/CheckHost.dat
- Size 64KB
- SHA256 61758d92984748bc403f9fa82c2cdbc2804844f7d912a8f13157ab1fe756ddf2
- MD5 69fea6383150f848d24d2082a9121b89
- SHA1 bb1423faad1167e568002b956b040b5f7481361d
- SHA512 c540e16f1cf2d15bf5e7003dd7cd91f8914339661b7e47eafbe5a6cf8ef9ceae6490c49cf659b31057aabdc29baa92a98f8d45d87c8750e7e4049f4787b18169
- SSDEEP 768:pdSVMqiw5nDrusYU5gI4vkvT53rS3LhvZ9riB951lSv77oxF:pl4Ey3rS3Z3Gl6o
- TLSH
  T141538E2738C288BBD95545F014DA0B376E36A2241351D8D7DF64DCB2AC63EBCD63A24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  X-Scan-v3.3/UnZip32.dll
- Size 96KB
- SHA256 e8872c2741248c745b7db4b21875c64ab55808335268236b30830561798d700d
- MD5 5ed1ba3e2da053e024378eaab62c531f
- SHA1 145390e808e15c3df51dd6666c94a6ba5f03a4d6
- SHA512 0e058b265b7c43c3f1c462b9fee1481c086070464a11bac7ad5ea81ef892296bc0d68e783dbb02be2b35de249de9290ac974490ff024ff989c3745b2a44ba3d1
- SSDEEP 1536:QE74ywjIp+P7MryYhXrh4fU1cgUw+omYOfZIozM:D8b7MryYhXr+s1cgUwmfZ5zM
- TLSH
  T12FA36B92BACB81F5DE47943A114563BE9A329D0120349287F37CEDFBDA15312E37A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  X-Scan-v3.3/Update.exe
- Size 1.5MB
- SHA256 abf3e0c3f393d0429fe8721f57644ad880d414213bb9cd2524dcb8495274fc7e
- MD5 50c0595588c3c54a0c1e8b817fdc18c8
- SHA1 02a32abd376b54d75159dc7a0ba4d5cb2fce581a
- SHA512 b169975ecc3f6ac9b133f2d980bb6ff2f9caa7ecb38bfcad23bd468d54213eb7748f9a6435aa125d924fbe1d04ec67acb24bfa70fa6bc45f98bae78123a0e7ea
- SSDEEP 24576:2nsJ39LyjbJkQFMhmC+6GD92s23EdGLmDYuUpK5BKUE/X05lMR:2nsHyjtk2MYC5GDq7SDgsKU2CMR
- TLSH
  T19F758D22B2A18437C1231B389CAFA3A5593ABF512E34A94B7BF41E4C5F397813D152D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  X-Scan-v3.3/XScanLib.dll
- Size 72KB
- SHA256 910d36b710ea0dd2177cd2e8342fab6f1766beb8a727654930bf0bf99552c1e1
- MD5 d89a932a364e4d37eea076314bb754d0
- SHA1 c5cb4f75cf241f5a9aea324783193433a42a13b0
- SHA512 3a6cc2051efdeca7f46298576a9b4ac8d22f3fd39245816e3b2e538734915dcfac2606b6cc81c994d16d6ac3e8ff66143678cca84afd9f009f89f741160e8f42
- SSDEEP 768:bHzLevIyUm/H1TM3fTZEj4bcwIJEl8qcVqiB9U7d3RIBJzoA6PPJVBv:KwydkTZXCEpZD4oDLB
- TLSH
  T1A9739E2274B288B2D188463560E64B3BBB7DAA214FD784D3CF59DC451D716A3F32B34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  X-Scan-v3.3/dat/NaslLib.dll
- Size 272KB
- SHA256 deed3fa5594b8bc89f0069d5aa2d5db477573ed343f69304c63e884dab6d9abb
- MD5 106c80988b320918d793f16ad3601e4b
- SHA1 fb0d4263118faaeed2d68e12fab24c59953e862d
- SHA512 87c7f66951db89cb713eb1351d6ff2c5bdc0893a2decfaa14385f2578983328be16fe9f3f99fa0dfb71b1d18c2f04300a902c0dd6a55f859de94d64356b29164
- SSDEEP 6144:7ZibUE20MSes+uiadmngULLWvh1wsGCXFhkeCtKuIc+Un4hw:1E20IsuKizLWJ1wsrVhkeCt1IcNn4
- TLSH
  T13D448D03198280F2FEE924B611AB27369F3971054317D687DB64FCEAAD37612B51D38E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  X-Scan-v3.3/dat/WinPcap_3_1_beta4.exe
- Size 1.2MB
- SHA256 8a696b6c55f8fd1c409058e0f0c18c16f584ffc53fdd0784e44179aec5655ed1
- MD5 f0c1fda886b488ab1883b3aa37df6640
- SHA1 c950e1fa18c0add5a01d8bf5693e9f4292a9922d
- SHA512 42bf6b76632ec08774141805514812a175afeeee7ed826abcb0ed542b44ee382466dbe8ff92d0b74e97d6d7e868c910cbce9c93d15b01ffaf7e93726828be5bc
- SSDEEP 24576:rnsJ39LyjbJkQFMhmC+6GD9BSWdCW6ApD5zH6MAQCmS8:rnsHyjtk2MYC5GDLVOIDR1Ao5
- TLSH
  T15D45BF32F2D19437D1325A3D9C6BA3A5582ABF512E38794E3BE42E4C5F3D68238152D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence upx
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  X-Scan-v3.3/dat/ipsearcher.dll
- Size 68KB
- SHA256 312a51732a65e157be9f4695e92ce629346388f1f348d6c1e47ebb7183468c38
- MD5 775e55a778168ebafe3ae12bc1ac78ab
- SHA1 1e96e9c5c56fcbea94d26ce0b3f1548b224a4791
- SHA512 633effbef4f44101b4ae5d6b748c3f9e502319edb97fd995ee347401941de4ad70f23dab044eeafa2791dbada10bacc5314e93b355351094139b75f2cb4c5eb7
- SSDEEP 1536:/58RyMI0v+DvRfbzDQclb0fqZwWWJ5zocV:h390M5PQzD5J5EcV
- TLSH
  T1A0639E127293C8B6D84E153524A65736777EBC1116F588936F6D1B8CFE322E0BE36382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  X-Scan-v3.3/dat/nmap/nmap.exe
- Size 1.1MB
- SHA256 68c5ac4acd7ad4c8921eebb036851e4647e4dc07063a74c421da05de44f2daaa
- MD5 dcf30860b5d39c422b781a1dfd8c339d
- SHA1 7b243cfec2c7cf516662b0706dcba1c29b324488
- SHA512 7bf1eb3a9d8052f051db7e0391620ac4547a69926233b762eb548a84aa4e520d9515866c901c7ff6df2cb5cd8b16b4d8fbca95179363c0750e67524d2d161fd1
- SSDEEP 24576:dnsJ39LyjbJkQFMhmC+6GD9Gyw2sJiORcYgvyk/wz3aLUGfQ6P7:dnsHyjtk2MYC5GD1w/KA6M3aLUGfQ+7
- TLSH
  T18C35AE22F2D28433C17316398D5B97B5A83ABE602E34794B7BF81E4C5F3968169352D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  X-Scan-v3.3/dat/npf.sys
- Size 32KB
- SHA256 b77c6d94aa246611fa80d48dec09a8c5b79fcbaa4627e1bec6b0d912beb0b757
- MD5 74a1d72a79a58436159c924cc34f1c1d
- SHA1 8aa2a92d288a958cbe08f7e2ec875b155ce70335
- SHA512 f22f94f7d5298f817f1fe42ff36d7450ebc6dce3f504f6077d3726b5e717ee0da84933902b267d6e3c996d426b9d2f084c1f70aab1871271a1b1f9404cb0ee09
- SSDEEP 768:R2JBB8KK4UcEUHw0KhFdb1HeqHW84s0oo03svA1k5hpqJ8ij:8BBVttQ0UbX4s0ooBA1Epqui
- TLSH
  T191E216C3328C403DC1FD4E36D6E5272432279B296B60F976E8543BA2971ED93F99121B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  X-Scan-v3.3/dat/report.dll
- Size 96KB
- SHA256 333b199b0ee923057d31cde176c852eccc16704ca84ed492fbd4c110202e78c4
- MD5 f0ef84caf10b64afc7c9af4049a16e54
- SHA1 4582a7c1d499bb96dad8e9b227e9d5de9becdfc2
- SHA512 0cc0fa6689a2a04f777e95059f9274ae50617bf3049b806f85b760bb930f33f28b83100401b06cfc040bd1ca5f73104e9df8bd108a33a4b87f1dc6770aa3da8c
- SSDEEP 1536:gHd2q41FyysyctCQSPTBBkIs5d9J6hxoQ7JwoE:sIWyctCQmaduxo
- TLSH
  T16DA3AF0668C1C1B6F555C47750A29B37DABA321103E6D8D3DF68DDE28F606A0972E38F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  X-Scan-v3.3/dat/snmp_pass.dic
- Size 582B
- SHA256 83f3f939eb3067e43916108d50bdca93a069e37aadbb6da347c7ad084a626b7d
- MD5 2fc906dce210d23c56d10ddb911a7d82
- SHA1 8d1f9bece11b13d85a7965bd5ef997f670b1a80a
- SHA512 c87b76e315c3368c0fbfc93abbf60fb75d0aee8d073db33943b3d213d221b9b2b63b04531074a688ee28e0ff2d45d7441772bca8eaeda32ccfb3fc02e1c13f7c
- TLSH
  T1F4F0E1349EDDA941670C95F3D0000F2EB298DC071F973A89528764FEB6CBA5CAA141A3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  X-Scan-v3.3/dat/ssh.dll
- Size 280KB
- SHA256 2f234d7968bc63b53413910729fe84656f3df35a9e122ece53e060d2c96f9b74
- MD5 98df7a80f02a150e363b9d83b8446199
- SHA1 9d9ef47d7d75c4f84d7cd3808f66b340b0a1c2bb
- SHA512 165c2d0504911e92d78d4e28ae4722f335c4a9081d6ad1fb9272b343010b6ec5b34aa8cfc2d073c3f8c483c7038ad9c761a4ba8b9c61bba2d2778a3ded84be32
- SSDEEP 6144:KOC4h1CdqGJ3lKTjS8tnU3kc565cnDtRhlCPnfFyrZBrdZ6hN0qkijQN3Wd:ZC4hR6kTtnU3kc5650DSffFyrZBrdMhv
- TLSH
  T1BD54BF82A6D289F1DD805A3810BA63379F7561092339D2D3DBA4CDD64D37161FE3A38E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  X-Scan-v3.3/dat/xpf.sys
- Size 5KB
- SHA256 1fa731501f57d32f39842873ffd72523586df68dd216a5ff95d1519729c97150
- MD5 b4802d3dbf4c26c3b9e5d2c1ea01e974
- SHA1 761125ab594f8dc996da4ce8ce50deba49c81846
- SHA512 815cd6f11e8c49614c5aa3b007743129986c83d528a65bb03b25a452e22e379ea05b3c3480859639e253b0f4309c417ebb89345d3381d8612d471cefb58bb621
- SSDEEP 48:6hTtPNyI7DgcH0w/yQd14UBPsvgBDR/RXyh5F:utA+gq0wRlkULc
- TLSH
  T1B2B1C532669ACC37C17A4ABA1E075E30D022B481A1ED121B154C58C5EEABE167E1D8D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  X-Scan-v3.3/libeay32.dll
- Size 836KB
- SHA256 8755b87c88af0adb10b698cd4746f821bb612dfd8d349cfd89859b1f62f8437b
- MD5 a61ec26bdc77712b34e1d1d5fdb97a3b
- SHA1 b908f914f91a31ee62a311c2a31a3d414693b784
- SHA512 58fe90d284dd8328ec6a2fccbbc894d1167ecd4c2cfbf01b5a7b81b3706e33e09e4950efaf8d2e9901372990447f4e4c20fa5393c4cfb638957859d2f35515a6
- SSDEEP 12288:/zvy2ZNqdpa0j4McGnqHYOaNx9WeCD03p2GcBe/v9:/zv1Ydpa0j4fRaNxHC4pbv/v9
- TLSH
  T1BF058E4BE98689F5EA4C047624F7273B9F374287425ADBC387B1D9529C22211B63F3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  X-Scan-v3.3/log/192_168_91_136_report.html
- Size 4KB
- SHA256 73d429819e5e9ade7bcc76d6709880c86353a290453a08b95f5d9aa161690807
- MD5 3a105116f53d96e61c1a07ca1f95eb26
- SHA1 38aa194c7bfddcb829b1c0b16ecfad8b8221292c
- SHA512 5c85eebf9d193f30d2df551ac7bcd0ae7beabec11d71ede6f6ed9810f8bc3b63a959b7ceda58b407661fd0c71092ef339cce27069089630e767d4babc41423e5
- SSDEEP 48:I/tRmR+vYv/iXSz8xsNajA4514P025Z54vC41zd5imR5iMuKMkl5S4x9C:Q0R+vYv/iXSzfaqyvvnAmRAK3l8wo
- TLSH
  T1EA91F10ED985FF16963ED2B5D0333AD88CE9700193B139B4B84D384BE3212658633AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops file in Drivers directory

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Family: Xred

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

UPX packed file

Drops file in System32 directory

Family: Xred

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32