xred | 76a35a6f6e761d930d32d98deac9c7861f98daf6726e87d54954ea802f2a4f6d

General

Target
76a35a6f6e761d930d32d98deac9c7861f98daf6726e87d54954ea802f2a4f6d
Size 12.7MB
Sample260804-k7mxragf78
SHA256 76a35a6f6e761d930d32d98deac9c7861f98daf6726e87d54954ea802f2a4f6d
MD5 16432f9ee1cb6147ac4d41bcd25d451a
SHA1 87696b42a008b3abaf64e75cd4ab46c7505b5530
SHA512 a9a727d9eeab4ac46ca58038dfb0b327338807e06437632dca796f7b77ed0030c8b0be225630a88031517004ade592a974e78edcfa303ee664416a454a3f1ae5
SSDEEP 393216:z0X4RRgkMQCL3Z3Hi6xEMXVep5AsvPof3OSSCfLBefO:z0YekMQcXRxEMle0svP0OLCz3
TLSH
T128D633D06A3655EA2AE3D7378D00293D028735E22274E53F2819D90CDB5DF7E82AF94D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  synaptics.exe
- Size 753KB
- SHA256 108fd4ceb01d81e6dd001aa5f13cb7a446d3dead6bce72f8955ee0263219c295
- MD5 63a8f07643dd71f63f619d54a4ba166a
- SHA1 4cf6d4f8f8fc04b16b29843910b1fc7523697543
- SHA512 d0632942f12fbd960bb36bd6e376f743087fe848bc663bed144f2c3add18ebdab26a659938819219a674bf4554e2c7bc1b99b8bb3bfb4cf85d3800e01f84c80c
- SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IOr:ansJ39LyjbJkQFMhmC+6GD9J
- TLSH
  T1A3F47D32F2D19437D1721A3D9C6BA3A5582ABE512E38794E3BF81E4C5F3D68138252D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  智能采血系统.exe
- Size 13.8MB
- SHA256 0bfbc06d0df2937507b2000a439a72affb3e8ddafb4da528f314ec48069e979c
- MD5 3e63b6a106bfcda1af3253db5ada4fd3
- SHA1 66f331a19ab15dc638215a924eb1502df53ca1f7
- SHA512 c6ba3cd75143045f305ec3a14d44f3457d999662ba0bc9ec6150761186132363d1ff72981d73e1a29454417cd1785feb29bc0f8eeb2d35c0d7c66b535cb9a2a8
- SSDEEP 393216:1BwC7IjAGQ5uwV+RwfUn7ugPybUG6LZeFi+WHBkhe2TpahS03pppUudHp1R6f0ea:PwIIsGdwZ7oyQVdeoihe2Tpaf3pppUun
- TLSH
  T109E622012660D937E03B47F789E326D5A3397A53E6EACF4C5DE7B4D83532B416A18883
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Adds Run key to start application
  persistence
behavioral3 behavioral4