xred | 163d0d286239e9db0695a33ef518151d8a9c8d2c3065e95ded06e9e276bf98ce

General

Target
Potato Graphics Pack.zip
Size 812KB
Sample261009-xdjpfsdf97
SHA256 163d0d286239e9db0695a33ef518151d8a9c8d2c3065e95ded06e9e276bf98ce
MD5 779949121fc5a73e3c4a6528242fc90f
SHA1 3ad2d7ab2d75d94db1bb9d4a4857880396d5b40f
SHA512 1ddaf3a7b5891cd64cf281ecc9c5eaafe40fbf3a10687c42ac128bc9ab90b8e0af3c02deae1b370a30c9fe083a928042264f5a04f7121fd434bfcf054aae6792
SSDEEP 12288:Zik4c9XBdPCcDo+MRbMZdA9+iNaAxeiElvfOxkuuGlpCNI3a7SnEqMS:gc9XPCh+6giaAFEJfOhvANIhnD
TLSH
T13E052325010F1E38F18F99FBEE9B0E948BDAC81098D7E575F6488E33F5CD2A5892491D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  Potato Graphics Pack (Updated)/AMD-Intel/Poatato Graphics For AMD-Intel.bat
- Size 56KB
- SHA256 c8b23ed5f875785c6606b910901ca0304fb411077a90648136164475a61cf212
- MD5 6585082b1172872e4de405067fd27336
- SHA1 1b313584538c896e9d0ad3e75607adca62af6836
- SHA512 a4efd15d1500c12238d61ad13df2ecf9bcd75da50b7f5f07d7f9b7e89649656db78cf2d9472d61476837ef17a89f1ed89953b0ecd7c8785651419ed03a5b96e7
- SSDEEP 384:qFVOP9FnSXE9ADGNWV4bso10f23a9hMXI8xITv+F+azOBgtsnD65Ck5QLk5QL6hb:FnxVHuibk3ilv
- TLSH
  T1A743E40257FD4177DE5567283362F506492CE432AB8CBB372AE8269BF6CC34861F16E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Potato Graphics Pack (Updated)/Nvidia/nvidiaProfileInspector.exe
- Size 1.7MB
- SHA256 bd69d43b587411c874fa28d57abb14c389f19769896a2abe94cb323f0771baf2
- MD5 c652aaf8533b1e1690063ea2d26a28ed
- SHA1 79c4676e9ac660f5d5e2d7a09898143511dca593
- SHA512 0b284ea830480c698a456a1fe0a18f8246c796efcf714c9c2e4dcead75366999edf33f7d03bf57207258b0da5fa3969cfb838fa9ee9446b4ecbc0d1647bd48ff
- SSDEEP 24576:SnsJ39LyjbJkQFMhmC+6GD9cjrT7UdfICR5l3apYF9izdMGk1:SnsHyjtk2MYC5GDfICR5Bf
- TLSH
  T15485080E71EC987ADB0505F2F43F2229992FFE550A95121C79BC3A777862EC52580A3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4