xred | b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630

General

Target
b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630
Size 578KB
Sample260822-p3qkasvbkf
SHA256 b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630
MD5 bb34fef204a22b6f3525f85bad032835
SHA1 005e03a4cdb37099eabf3ff73af9bdeea4e73080
SHA512 2783a9ffafb3f347da2acf1eb1e345ddee1e0d57fbae4d846ebe818a43f83f36b201536a972e1c66713fe5390415d60e665726c330fb2dc7130898b85c07be8b
SSDEEP 12288:gcVTKejHCpsQrYmea+0WAy7TgGI84WZ12jB74/xWOCjxjZDv:tTJJIYmeahXy7TgGI8402jOwVDv
TLSH
T1DBC42312B62C6A7B6750F3F17E1E48352B763CFB053E3261B8506DF24858E8EDC64698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  新建文件夹/splwow64.exe
- Size 1.1MB
- SHA256 f06076f9316264bd38fc71ab256553ab48b3583d900d899326a71c1565134dcf
- MD5 ddce97637d35d19bdbaa773f14ac7330
- SHA1 50ba085fdaf391e4981c6e468dfa437d6ee4b02c
- SHA512 9c5f7361493441c67be5fd973d3481a37516c0069c3aa3aff863da13607e8b7c9512d11daf21bb6c02d9e3724731981e69ec3193cd22283a6eb8b35db962816d
- SSDEEP 24576:NnsJ39LyjbJkQFMhmC+6GD9TWVJgEjPYPkp9Y7ku7uJDtYICCud9rtC8Q6fCw8wY:NnsHyjtk2MYC5GDlWVJgEjPYPkp9Y7kX
- TLSH
  T19C355E12A3D0553BC4771A394CE7535F4A36BF021F18AB4E36E41D995E36BC32C0ABA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  新建文件夹/wxrjsqxyz.sys
- Size 89KB
- SHA256 47ea05b9c698bd49ad9a86036a13712ead900b31eb9f3f0b8882a32a33c66b57
- MD5 d90148d58a7e53c4cc07ac5d051d8f9e
- SHA1 020b20ee131fee2fa6629dcfa8ced60657a66b2f
- SHA512 c7fbe42a532122efedce3ec5d1da80f19315cfa00930955f519101094002269a674a4828de534f78601e9aceb08f69c9787ce3ce72cb71b1cd1b08013fa98000
- SSDEEP 1536:d9a8PGsyXylc6daSyOX9RjA0DDs3oUzQ7gZa+7gZS:LG1ol8Wc6sT0N+d
- TLSH
  T183938EAA419410F9DD0BC574DAF8E667DEB6B0522F3097CF13A0C6501F92FC26A7C295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3