General
- Target d79472989c496d94d8fbd30633bf4ae9df63ed64fb74c4e2884b6b6e17cb95bd
- Size 13.1MB
- Sample260817-sh9dfsdk4x
- SHA256 d79472989c496d94d8fbd30633bf4ae9df63ed64fb74c4e2884b6b6e17cb95bd
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Targets
-
- Target SKCC/skeet-insecure.exe
- Size 776KB
- SHA256 430e7f66ffb2597d4c4a7860d2941948163381709606f678ead2fb2ec01f0191
Score10/10-
Family: Xred
Xred is backdoor written in Delphi.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
- Target SKCC/skeet-vac.exe
- Size 756KB
- SHA256 0df0bcf0745bfcb769551e8f6c55323eb4d3ee83f16307fcf9b8b607002d5228
Score10/10-
Family: Xred
Xred is backdoor written in Delphi.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
- Target SKCC/skeet.dll
- Size 13.3MB
- SHA256 0ce31cea27fecc4a67092d81f79ed8fc08d5c8bacc18ac9658083b3e8ca667e1
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/! 10$ RESOLVER.lua
- Size 13KB
- SHA256 a1f7503ae46c53e49c137d9df416f772bad1569d1002916173a630bc11ba89f6
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/AA.lua
- Size 869KB
- SHA256 1b808923c6dc79217a814f67185f2517d4f843e849fff3c1a846104efa98ab2a
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Aesthetic2_3.lua
- Size 674KB
- SHA256 a19d7b04f9f20fc816d5f4b5fd2cec142c32f61dd3cb8bd2b68c939cb5d4c8ee
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Best wish resolver Jiuban (1).lua
- Size 45KB
- SHA256 a118c492bff9922b8e0b6afb6d6c4a4684be554da26c6b75b6a0ee518c49233b
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Evolution.lua
- Size 252KB
- SHA256 1753567e86ce38744f1cc4c0705b5b219265612a28831ce726809b1a8b5b2827
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Horus.lua
- Size 155KB
- SHA256 0488dc0c6201cb8c508f5b9b860195ea70046336272aa0716e007b3ec7c5639c
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Visionary Recode.lua
- Size 168KB
- SHA256 39ac3eee191756dba8993c7086cb3e9bdd3a8ce53f48cf1691d1c39a08c445c7
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/Xor-Bytes-Go.lua
- Size 241KB
- SHA256 1860c8faba63465b581429201054c128b4fb8afa282aeea952c1ae867cfc9b39
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/halflife.lua
- Size 154KB
- SHA256 1e10b8aa8e798d42a4b51dc8e8e256e8ba2e278d4425b20a8fe838595ddf8a42
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/luasense nextgen.lua
- Size 167KB
- SHA256 1e73f5857d62cb94cfc72ed6578a41cab524dcb1c641aeac8e9ea31289d37394
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/luasense-beta-gs (1).lua
- Size 72KB
- SHA256 23fb9ece4e5aaac97c5626a4aa7493e17f481bfa5da3bbf438e1618b7006ed57
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/universe - recode-obfuscated.lua
- Size 242KB
- SHA256 2e1cf560cf90670e30a1478ba908199c2e3d55797f3fbd95fec554d7401c0800
Score3/10 -
- Target 参数、lua/各路收集/SKCC Lua/3/【鸟爆】Best wish resolver Jiuban_Learning.lua
- Size 85KB
- SHA256 8e445e68643e4a5af30851a5381d087b14919592e643c3cf23ea6b389e65e687
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1