xred | c0cb6d4e2f3575978ddc6da1e096d22b785cd33b4478c1d70ff24b9177e29921

General

Target
31072026_1622_31072026_新建文件夹 (2)(3) (1).zip
Size 1.8MB
Sample260731-tvgpmsdc69
SHA256 c0cb6d4e2f3575978ddc6da1e096d22b785cd33b4478c1d70ff24b9177e29921
MD5 b857b988defff871f7b15660157c4d1b
SHA1 2c05a51381950b3f7fffc8518d95205fcbcc55fb
SHA512 57d374b379dd4c9f408b4de6ac4eb091b70bf51ecd037725fb9f43611588abe361e8c31c4058c9e012b3664a792e8446fd48e27794d2d171d1a9facb4bac5560
SSDEEP 49152:IvmlpxOU/rSIRGEU4GLZNjoSAaJSf9TzwL7fPjcG+/rTC3:IvYPOUeINsZNjoSAavL7Hjge3
TLSH
T14E95339038B861FF911FD8568D98BCA128F780B679A50B322D03B0BD5EE850794DB5CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  Wub.exe
- Size 1.5MB
- SHA256 5b9f87db0e57f59cb298447d7fea3879d356f876ebd44fd0ef69a7fe6cb93eae
- MD5 fb87e22b5e8417fb6d3396a175a88548
- SHA1 0fe03ceb49e62ef87b00f9c0dc64d9713a94c232
- SHA512 bef50a8c41d52610114feb0eed2bbc2e0c2cb82a263f0fd44781083d359409b70112ff22cedae2cdb18b0f756428655f7b8e92645de0bf36135d59c080e2c607
- SSDEEP 24576:insJ39LyjbJkQFMhmC+6GD9jaHMv6CWrj8nyTQrv2TAMI3uo:insHyjtk2MYC5GDh1vYjvTQf3p
- TLSH
  T11775CF22F3D28073D5733A385C6BE36999397A101E35A98B7BF42E5D8F352412A253D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Modifies security service
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Wub_x64.exe
- Size 939KB
- SHA256 187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
- MD5 9d6778f7f274f7ecd4e7e875a7268b64
- SHA1 452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa
- SHA512 d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87
- SSDEEP 24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI
- TLSH
  T1D4159E59F6E444B9C47FE17ACE46C22BE2F1B809537597CF06A04E6A1F23BD06936321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion
- Modifies security service
  defense_evasion
behavioral3 behavioral4