Overview

overview

10

Static

static

10

UE5自由�...nt.exe

windows10-2004-x64

1

UE5自由�...nt.exe

windows11-21h2-x64

1

UE5自由�...er.dll

windows10-2004-x64

1

UE5自由�...er.dll

windows11-21h2-x64

1

UE5自由�...nt.exe

windows10-2004-x64

10

UE5自由�...nt.exe

windows11-21h2-x64

10

UE5自由�...rs.dll

windows10-2004-x64

1

UE5自由�...rs.dll

windows11-21h2-x64

1

UE5自由�...ls.dll

windows10-2004-x64

1

UE5自由�...ls.dll

windows11-21h2-x64

1

UE5自由�...pf.dll

windows10-2004-x64

1

UE5自由�...pf.dll

windows11-21h2-x64

1

UE5自由�...le.dll

windows10-2004-x64

1

UE5自由�...le.dll

windows11-21h2-x64

1

UE5自由�...ns.dll

windows10-2004-x64

1

UE5自由�...ns.dll

windows11-21h2-x64

1

UE5自由�...er.dll

windows10-2004-x64

1

UE5自由�...er.dll

windows11-21h2-x64

1

ue4ss/Mods...ect.js

windows10-2004-x64

3

ue4ss/Mods...ect.js

windows11-21h2-x64

3

ue4ss/Mods...ers.js

windows10-2004-x64

3

ue4ss/Mods...ers.js

windows11-21h2-x64

3

ue4ss/xinput1_3.dll

windows10-2004-x64

1

ue4ss/xinput1_3.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    9b2f0c954936dcd3f1741279e8b5b2b8c5b294c0316213b479db5b8ce852634a
  • Size 4.9MB
  • Sample260415-pm286aes6j
  • SHA256 9b2f0c954936dcd3f1741279e8b5b2b8c5b294c0316213b479db5b8ce852634a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xredbackdoordefense_evasiondiscoveryexecutionpersistence

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

    • Target
      UE5自由视角_v523/._cache_IGCSClient.exe
    • Size 764KB
    • SHA256 34028249b136ea3d9f4946d023f925df905b191023e6d859b3170b1f8dc967b6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    defense_evasion
    behavioral1behavioral2
    • Target
      UE5自由视角_v523/ColorPicker.dll
    • Size 119KB
    • SHA256 354d8742d5d4931ec18d0617a4c20fa156c655469fd2a0e63245488375f6955f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      UE5自由视角_v523/IGCSClient.exe
    • Size 1.5MB
    • SHA256 b0fc8601c2e05296df9d2544d840f3e970c6f4c3d9c3013610c02244c530046e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryxredpersistence

    • Family: Xred

      Xred is backdoor written in Delphi.

      backdoorxred

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral5behavioral6
    • Target
      UE5自由视角_v523/Microsoft.Xaml.Behaviors.dll
    • Size 141KB
    • SHA256 cc62aac669a524bf4f4ec80b6493b1a920b1a6b999cf39647b9a1e8f6e959b4e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      UE5自由视角_v523/ModernWpf.Controls.dll
    • Size 684KB
    • SHA256 c78f30f3071e4d75a4781a024eb0ba0b4818f6bdfdaf3a1d5c385ee8ae479bb8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      UE5自由视角_v523/ModernWpf.dll
    • Size 893KB
    • SHA256 ae0eb8af5f0c842f5ab7a689f9fbdaded75897ceb45c5500428cbef0beea5277
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      UE5自由视角_v523/System.ValueTuple.dll
    • Size 77KB
    • SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      UE5自由视角_v523/ToastNotifications.dll
    • Size 107KB
    • SHA256 ed1297117c8dba2b3880246721af5b74c6ae16d745bea176adbeefc1ee75f2fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      UE5自由视角_v523/UniversalUE5Unlocker.dll
    • Size 2.4MB
    • SHA256 5a1e70e811a949a5b7bc9a0dc0a5c53ed792404890f61b490ec5adb4101b6b86
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      ue4ss/Mods/ConsoleCommandsMod/Scripts/dump_object.lua
    • Size 12KB
    • SHA256 de2e9f21c5c6bf3acf7e17f556b2ba8533d769fb2564f63523896f02cd78122f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      ue4ss/Mods/shared/UEHelpers/UEHelpers.lua
    • Size 3KB
    • SHA256 f29536ea169caccdc0d26b8de014d1f24edcc4e629cbf4651ae60dc10e184ff3
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      ue4ss/xinput1_3.dll
    • Size 6.6MB
    • SHA256 20084cb578c6e5d3d54d736c29555b948a0ea5b5070ae3e4da1a97a2f94e36ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v16

Tasks