xred | 51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6

Sharing

Copy URL Twitter E-mail

General

Target
51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6
Size 1.4MB
Sample261104-d6mr2acc66
SHA256 51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6
MD5 fde725808841019150623a7824af9041
SHA1 9933dbb52ff6f538f72202aeda0476a6f0694084
SHA512 3c489c2e77b80fa2f3b58fe451bb66e5ff67ae4715cf1a3954d53e72f33a9d1911c31224c0d60bca67e0612ffa92ae23539a7f8c52ebab8dd12f6b85fe61f5f7
SSDEEP 24576:VOy6P1FtVBKRqiP/HbIxLs7Pof/0GgEp031xu9XuL2ceey4HwIIpXnFG0c2xTB:VOy6NFL8RDP/kUajgEK31xuR4XyUw9pR
TLSH
T1496533630E530C0AE4E76FDB7EE3E5F80BF92E458D0280D6BC4BB268A97D4785647464
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  D300I-CSR011414-BW256B-EN-261023-GD427-Updater/._cache_D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe
- Size 972KB
- SHA256 cf0a70575a4a92f70e990dd4849b1d47b7fe5a4dd524f0d3067448a318177844
- MD5 76e46667b1530729ee7ce2784f470956
- SHA1 a941bbcb337344ae7d3edcd1c8600788c565f37f
- SHA512 7b5173ee04956fab0e48a0d987e9d89711091d98201ed48caab00e228577e2e49b53effd08b150009d352ce110ee23cf8387dc88cd2d92fe813e96e3161593ae
- SSDEEP 24576:5zorduPKuh0k2PMX+/DmLDzsordZorpy:5gAPKuh0k20u0g
- TLSH
  T11D25CF40FD472986DB3C867843726EE047AE7D3A9A00D2CD5988B48A1772B435667CFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  D300I-CSR011414-BW256B-EN-261023-GD427-Updater/D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe
- Size 1.7MB
- SHA256 3d5c2def5b60ff0ec1db5b02b640ae37954cdc06b8d64469fbf37cf65a5a31b3
- MD5 bd245ff0a721140894ebc9d2fa1b4217
- SHA1 78d872acd6a41b367e91c636262779eb249736f5
- SHA512 e25c70a21fd89bd47a15c6f0941a8e93a97f5f21e2896dc8f4a54514174d95b34a4bda00ef37b59c8223d14a9e031ae2082ca74db7b087404a134116bc1cdf89
- SSDEEP 24576:ansJ39LyjbJkQFMhmC+6GD9hTzorduPKuh0k2PMX+/DmLDzsordZorpyl:ansHyjtk2MYC5GDbgAPKuh0k20u0gs
- TLSH
  T11385CF21F6835433D739463C8E67ABA4492E7E352E20E58E3BD83D4D0F3578229265E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  D300I-CSR011414-BW256B-EN-261023-GD427-Updater/IPAddressControlLib.dll
- Size 26KB
- SHA256 a7f16e53bc3c66ecc7d92621291c2c58dead7a0136548920fb3395de8e687aeb
- MD5 394d7b7cacba3519ef29d5c624fb21ad
- SHA1 dd2192cedf633bc0a70d3e82bc747594e063fb39
- SHA512 b928e84db245343d455d38db243edcd8a3713ff9b52d75ad2708b1538006480520888f13e2f92ab9b1c95c10b1477b333a090ad8e799b6b61aade94e7feaae97
- SSDEEP 768:ck+izLvz9z0b1ivd+xRdzuP4L/Pu+qsqqe7Oz5:ck+izL79z0b1ivyeC/PuvsqB7Oz5
- TLSH
  T17AC22B006795C737DCBE8739B4D256010374E287A653DB2F9EF860BE5DBB3684402A6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  D300I-CSR011414-BW256B-EN-261023-GD427-Updater/libUsbContorl.dll
- Size 60KB
- SHA256 f92cdb7f7971f0fc24949e373015f8d1f6b04f434f429a95217f1262f3b5cabe
- MD5 30c79165c58d1c6ec9ba0755b6f85c60
- SHA1 5af710092fc0e94c6f2f064dfe50d7e1a41678d5
- SHA512 fa3212d211c69dbee7bf077acd4b2402cd7cf87546a76f1190d0852317025c99cf078b541c781c95806be4964c438f195274ecfa4a98471614e15f28046f3d50
- SSDEEP 1536:9Fqr93lVbt1bd97+qg3ZYDfP+nrxH/7zWTgz0St:9wX78YfPQ1Hf8bSt
- TLSH
  T1A5535C60E9562B7ACA49C8BFB0B3060225DA537A60057B3FC5DE829E243DFC11D25DF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Xred

Suspicious Office macro

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8