xred | d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7

General

Target
d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7
Size 2.7MB
Sample261101-e5gp3asxbz
SHA256 d8d6626208a81cecad87d65c39bff34b1dbbb84a59998fa904827ad31be8b2e7
MD5 679c36fac2bbb0821f92ba83bede5b83
SHA1 e70b5b1bb5ea5126d957cf2e699319adee77b14f
SHA512 cffaf362c7ed7ea92a1f4a298519d3a5262190ca704a4ba5953ef606b4c53ad87cc164529e7299c45884b568029bd718cb6508fbe3d140c2ddde2ba9e11fe968
SSDEEP 49152:Cp16z+9HVk0Sy1kdPmHxkHVnqt9tpWHMos2lInbGdZ7qoOMAjpb+SagztSIq:B6FSyOk6HVw9VGH7HOMA4
TLSH
T189D53374879E3095C38E937F47868A49F4F41D2B0A875B504CA1ABFEC687843E0F6E65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  WinHex20Pro/WinHex_v20.5_x86_x64.exe
- Size 3.0MB
- SHA256 02c8fa008710affd57be5c6d79f68ee66ee43e742243679d7af3dbba1d4c95f8
- MD5 c2d6190998103692a506a80e2aec9ccb
- SHA1 7f1858fafbb913deab4764f4d1b8b8badb9359b9
- SHA512 ed7ad952820ea67fd907bdc3fa710e398f147cc5e88fd4e2e9cf00df6eeade9e8828fff8fe1eae059e35ceff0232cafc6b53e3c18f7d2b16034d4939aabad0d1
- SSDEEP 49152:XnsHyjtk2MYC5GDeOiSfk/hmT3ifRjgRXNTAlQoseRc3bg7hLSYaQ6f/lgWag7yl:Xnsmtk2aZOiScUOfRKXdg1LzaQ6Tu
- TLSH
  T1CEE50232F2D29437D1321B3D9C5B93A598297E512E38794A3BF41E4D8F3E68238652D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence upx macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  WinHex20Pro/去脚本之家看看.url
- Size 124B
- SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
- MD5 9d9c794d654383c012286b258556fe46
- SHA1 8266c2159f57859ff102df419a94157a2ccef61f
- SHA512 28b9a9519a0fb7e826adaf43e76dfd11df323f20ab3089ec53c6263a51c06635c9d0b0a325cb7d20f7db42734dc257666e77d63be620aca34cdb13b766da9bbe
- TLSH
  T126B012EC6A45C29BD372D80B71F0FD14A80F7DE088C2D5DC6680DD8A6C850C0D48AF66
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WinHex20Pro/服务器软件.url
- Size 112B
- SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
- MD5 db4aa2c6c4e0555b3968690756e24836
- SHA1 96933b815ecdcf2fd43bd2ef036260029a633801
- SHA512 6ca491f92f9990d706b75e7ff091f8c025de7d9dc438aa25cf6e8baa87e750f6f0490e9923d82aa00ac074b572468349ed52c2765ec1fd3183a9ea146a2ff5c3
- TLSH
  T133B012AC6D44C29ED152C80B70B0F844A80F7DE048C2D48CE590DD8A2C05080D487F56
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6