xred | b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630

Sharing

Copy URL Twitter E-mail

General

Target
b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630
Size 578KB
Sample260822-p3qkasvbkf
SHA256 b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630
MD5 bb34fef204a22b6f3525f85bad032835
SHA1 005e03a4cdb37099eabf3ff73af9bdeea4e73080
SHA512 2783a9ffafb3f347da2acf1eb1e345ddee1e0d57fbae4d846ebe818a43f83f36b201536a972e1c66713fe5390415d60e665726c330fb2dc7130898b85c07be8b
SSDEEP 12288:gcVTKejHCpsQrYmea+0WAy7TgGI84WZ12jB74/xWOCjxjZDv:tTJJIYmeahXy7TgGI8402jOwVDv
TLSH
T1DBC42312B62C6A7B6750F3F17E1E48352B763CFB053E3261B8506DF24858E8EDC64698
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/新建文件夹/splwow64.exe
unpack001/新建文件夹/wxrjsqxyz.sys

File Explorer

b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630

.zip 578KB
新建文件夹/WindowsSystemUpdate

3KB
新建文件夹/splwow64

3KB
新建文件夹/splwow64.exe

.exe 1.1MB
新建文件夹/wxrjsqxyz.sys

.sys 89KB

b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630

SHA256 b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630
MD5 bb34fef204a22b6f3525f85bad032835
SHA1 005e03a4cdb37099eabf3ff73af9bdeea4e73080
SHA512 2783a9ffafb3f347da2acf1eb1e345ddee1e0d57fbae4d846ebe818a43f83f36b201536a972e1c66713fe5390415d60e665726c330fb2dc7130898b85c07be8b
SSDEEP 12288:gcVTKejHCpsQrYmea+0WAy7TgGI84WZ12jB74/xWOCjxjZDv:tTJJIYmeahXy7TgGI8402jOwVDv
TLSH
T1DBC42312B62C6A7B6750F3F17E1E48352B763CFB053E3261B8506DF24858E8EDC64698
MD5 SHA1 SHA512 SSDEEP TLSH

新建文件夹/splwow64.exe

SHA256 f06076f9316264bd38fc71ab256553ab48b3583d900d899326a71c1565134dcf
MD5 ddce97637d35d19bdbaa773f14ac7330
SHA1 50ba085fdaf391e4981c6e468dfa437d6ee4b02c
SHA512 9c5f7361493441c67be5fd973d3481a37516c0069c3aa3aff863da13607e8b7c9512d11daf21bb6c02d9e3724731981e69ec3193cd22283a6eb8b35db962816d
SSDEEP 24576:NnsJ39LyjbJkQFMhmC+6GD9TWVJgEjPYPkp9Y7ku7uJDtYICCud9rtC8Q6fCw8wY:NnsHyjtk2MYC5GDlWVJgEjPYPkp9Y7kX
TLSH
T19C355E12A3D0553BC4771A394CE7535F4A36BF021F18AB4E36E41D995E36BC32C0ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

423KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

新建文件夹/wxrjsqxyz.sys

IMPHASH f68590a3082ba9de89f62d57935c72ff
SHA256 47ea05b9c698bd49ad9a86036a13712ead900b31eb9f3f0b8882a32a33c66b57
MD5 d90148d58a7e53c4cc07ac5d051d8f9e
SHA1 020b20ee131fee2fa6629dcfa8ced60657a66b2f
SHA512 c7fbe42a532122efedce3ec5d1da80f19315cfa00930955f519101094002269a674a4828de534f78601e9aceb08f69c9787ce3ce72cb71b1cd1b08013fa98000
SSDEEP 1536:d9a8PGsyXylc6daSyOX9RjA0DDs3oUzQ7gZa+7gZS:LG1ol8Wc6sT0N+d
TLSH
T183938EAA419410F9DD0BC574DAF8E667DEB6B0522F3097CF13A0C6501F92FC26A7C295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

680B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

b85197b260eab56d7eef5631aab19f9baaf9d240ea976fca617474d85f749630

新建文件夹/WindowsSystemUpdate

新建文件夹/splwow64

新建文件夹/splwow64.exe

generic

新建文件夹/wxrjsqxyz.sys

ndis.sys

fwpkclnt.sys

ntoskrnl.exe

generic