xred | 5a06d9fbe932e822217ace5ef4d80506856f518408c9c08df878bce9740814f8

Sharing

Copy URL Twitter E-mail

General

Target
SENSI MS BYPASS-ALTERNATIVO.rar
Size 674.8MB
Sample260719-d1tcmaaz2n
SHA256 5a06d9fbe932e822217ace5ef4d80506856f518408c9c08df878bce9740814f8
MD5 a4f57a8d6dd59dd9b51e9304ab86c441
SHA1 3a9a655b21814ec7df5d5e532063b76dc6394d7f
SHA512 08f3308881f75d2ae4e52b655c858672ccaf4a65820e974993efece4aaf464d3f57d3f1a276e7b83ab90ad45786d1141f784e9ac9b3ba4c0f7319f4edb2180da
SSDEEP 12582912:qKrRL/fDkoiuSuxoqiSR4zD4aTTIdzdsPTPXPDT0QkllqmfL8qm9Tm2mpxi1BxYT:/DIPpqiVn949dQPQ3fL8BkSLyx
TLSH
T1457933488F69B47EFC888A121FA1F90AD7D637354689FC76FD58274684CF6E202CA075
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft DirectX/dsetup32.dll
- Size 1.5MB
- SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
- MD5 a5412a144f63d639b47fcc1ba68cb029
- SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
- SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
- SSDEEP 24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
- TLSH
  T1EB759D31B1D40332EA7103B177128AB7F63EEB9DE119D62579AE82592182B9CC37E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft DirectX/dxupdate.dll
- Size 173KB
- SHA256 300abf15fc1b38373053b898ad9a57098fa5656f26325f45b3d644befa74d428
- MD5 a2a0da126c1a2f8b615b363e862989a2
- SHA1 7716675d561b939f8bd22306d05e9671c7da0014
- SHA512 4b428749e2f207a2d7f3ccc5fc6c53a07a17f8f7b6055596531e0e71f4f2932494fe9f751e4251fb559931a91379f2f0504ac218f3c77127434d4abb9e869c73
- SSDEEP 3072:xp6LK2/wRi/9S7BLpKG/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTH6KaY:ywRaI3rfuFVeNgosUBxra4rIZsqq
- TLSH
  T1BE047C19FA40E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft DirectX/dxwsetup.exe
- Size 1.2MB
- SHA256 0988228a6783c41ccf60ea36bf837299f8146383265c04cc66919101207c9a18
- MD5 3eb264b91a3440a2837b678728c420a5
- SHA1 6a3a53f5860931dda9da0adbd98aab8c6f1bb54c
- SHA512 9c4ac35611b1bcf3aa8f29b79e20e4959ee46769153c5320a0644b709d10e40cf4f463358ce8b8df36f34ecae38aed167fe878fb42831657a21f63dfba308930
- SSDEEP 12288:+MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9SKAKJr4IWNNGp9pRTj:+nsJ39LyjbJkQFMhmC+6GD9UK+IqN4pv
- TLSH
  T1CB55F71172E0D536F2B31B386DBEE261487A7E506E38920D36951A4C1FF7B407868FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2005_x64.exe
- Size 4.1MB
- SHA256 bb9e8606e26c2b76984252182f7db0d6e9108b204b81d2a7b036c9b618c1f9f1
- MD5 524da2fb61a1361e77704e9466bcd74e
- SHA1 90a3d2a139c1a106bfccd98cbbd7c2c1d79f5ebe
- SHA512 78a29872ed0a6fd871bc31ca23c579204705ba1bca997e55267889b41f93679b025f4e77c68e012eb49e4e9807809039ce6c446148f3ad4e6176dd6d2ad2bfdb
- SSDEEP 98304:y4+PG8W44ij9RvbGOZUR241QZgC51B+PRPM:yPG8W4HhbVURp11CjgJM
- TLSH
  T190163322A1D9C829E0D1373548F160B60FB87C911EA4B65BA11ED1EB55B13D46F3E32B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2005_x86.exe
- Size 2.6MB
- SHA256 c615d7454875949fd969f95f114e168fbe8867c01f1a7db632f54f53c2ebe75c
- MD5 8649837a592f6b4f9235bfb7fb3f5c93
- SHA1 ae4b15e3677a4f5a711ddad84085b885945ddb0d
- SHA512 b1d8a8099a17ad2d82da3a2ea8f5f572166382892118a728de07caa36838ec0f528d5c140fa3cde70b08608947ac30d4935618cc5a36340e5b41cae83ab0bfe4
- SSDEEP 49152:kqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazkiWaR:kxxLFfY/KCCpKk9aWMzZyad
- TLSH
  T1C0C5331258C4D23AE0B317B499FD2A234B3D7CA8B620239FF78651A68C756C065357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2008_x64.exe
- Size 5.0MB
- SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- MD5 e2ada570911edaaae7d1b3c979345fce
- SHA1 a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA512 b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP 98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
- TLSH
  T10836337146138770D1E443B2789607CDFEA3ECA004226A7B9664FE2B5C05ABED59E70F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2008_x86.exe
- Size 4.3MB
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- TLSH
  T1982633EE1E32462AD70B42B2E4352783D578F0A68C7B8DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2010_x64.exe
- Size 9.8MB
- SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- MD5 c9d9eebccef20d637f193490cec05e79
- SHA1 15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA512 24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP 196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
- TLSH
  T189A6332DD2128E2EFEDB3730E1EE94EAD064D244C25722C3F15BB186B6B768D171E641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral15 behavioral16
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2010_x86.exe
- Size 8.6MB
- SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- MD5 1801436936e64598bab5b87b37dc7f87
- SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP 196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
- TLSH
  T1789633D714300ADFFC07BB70F7568555D8E9496233A8D7EA4AC60CC89AEEAE4C0B6750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral17 behavioral18
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2012_x64.exe
- Size 6.9MB
- SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- MD5 3c03562b5af9ed347614053d459d7778
- SHA1 1a5d93dddbc431ab27b1da711cd3370891542797
- SHA512 6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP 98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
- TLSH
  T1B876333286989427D1A32073F618D5217FBCB15C1F1048ABD3549A6D3B68AC6BEFB347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2012_x86.exe
- Size 6.3MB
- SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- MD5 7f52a19ecaf7db3c163dd164be3e592e
- SHA1 96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA512 60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP 196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
- TLSH
  T149663333B9549032D26214B3E555D670BE3D70282F2048FB9794DB1A39B89C6BBFB247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2013_x64.exe
- Size 6.9MB
- SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- MD5 49b1164f8e95ec6409ea83cdb352d8da
- SHA1 1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA512 29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP 196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
- TLSH
  T1EC76333296645127D1F20973F810E2207E3CB12D7F1044A3A794EEAD2EA95E667FB347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2013_x86.exe
- Size 6.2MB
- SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- MD5 38a1b890ce847167d16567cf7b7a5642
- SHA1 0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA512 907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP 196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
- TLSH
  T195663331E2649033D2F209B2F92497307E7DF2186710C4BAD658AE1D7A694D3A7FB253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2015_x64.exe
- Size 14.4MB
- SHA256 40ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
- MD5 be433764fa9bbe0f2f9c654f6512c9e0
- SHA1 b87c38d093872d7be7e191f01107b39c87888a5a
- SHA512 8a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191
- SSDEEP 393216:0+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS:0upttD7yBG/PcXU9g5
- TLSH
  T1DCE63332A698403AEBF20873AD54F6302E3DD618774448BBE2DCDC5D6E7519227FB612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/._cache_vcredist2015_x86.exe
- Size 13.7MB
- SHA256 e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
- MD5 24e8177b25c072f4fb0d37496ccdbb34
- SHA1 afa5badce64ee67290add24e0dc3d8210954ac6c
- SHA512 2fda8abc77b6ed9e98a2b120628e4e3b9458f2b18998c836eec1de82642244fe55234c7e52d6036d8b75c4b707a24f12fa639cc92d4234e94ed604a259d651e4
- SSDEEP 393216:1r/YlptVYmfr7yBG/49NMUSKlebwnJ40:1bEpttD7yBG/4M3OW
- TLSH
  T1D2E63332A598413AD7F30833AA58EA242E3DE128231489BBE3CCDD5D5E7519367FB711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  SENSI MS BYPASS ALTERNATIVO/PASO 2- INSTALAR REQUERIMIENTOS/Microsoft Visual C++/install_all.bat
- Size 952B
- SHA256 84e57c95fb1c5364cff4444fac99629d9c780b4cbbb693878ca559c697e85715
- MD5 d9ea81387ab9eda9ca3d6b5abc617877
- SHA1 6d0a1ed13d2e7e14bce51993e6e59e433ad58e86
- SHA512 94ede29821e7c4da1b46cb879c552fd7bb57b04cc010022d7b1a55ef313e2cfd528cbcde614097c48864fd540b8f06172da35ac19ae4d057ea5c071742398720
- TLSH
  T143114208A62E9DDABEF1F9DA155A3610FE03A56E02801F50E19349E8414FFC9FA26C01
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution xred persistence privilege_escalation ransomware macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Xred

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks system information in the registry

Family: Xred

Suspicious Office macro

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32