xred | 51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6

Sharing

Copy URL Twitter E-mail

General

Target
51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6
Size 1.4MB
Sample261104-d6mr2acc66
SHA256 51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6
MD5 fde725808841019150623a7824af9041
SHA1 9933dbb52ff6f538f72202aeda0476a6f0694084
SHA512 3c489c2e77b80fa2f3b58fe451bb66e5ff67ae4715cf1a3954d53e72f33a9d1911c31224c0d60bca67e0612ffa92ae23539a7f8c52ebab8dd12f6b85fe61f5f7
SSDEEP 24576:VOy6P1FtVBKRqiP/HbIxLs7Pof/0GgEp031xu9XuL2ceey4HwIIpXnFG0c2xTB:VOy6NFL8RDP/kUajgEK31xuR4XyUw9pR
TLSH
T1496533630E530C0AE4E76FDB7EE3E5F80BF92E458D0280D6BC4BB268A97D4785647464
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/D300I-CSR011414-BW256B-EN-261023-GD427-Updater/._cache_D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe
unpack001/D300I-CSR011414-BW256B-EN-261023-GD427-Updater/D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe
unpack001/D300I-CSR011414-BW256B-EN-261023-GD427-Updater/IPAddressControlLib.dll
unpack001/D300I-CSR011414-BW256B-EN-261023-GD427-Updater/libUsbContorl.dll

File Explorer

51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6

.zip 1.4MB
D300I-CSR011414-BW256B-EN-261023-GD427-Updater/._cache_D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

.exe 972KB
D300I-CSR011414-BW256B-EN-261023-GD427-Updater/D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

.exe 1.7MB
D300I-CSR011414-BW256B-EN-261023-GD427-Updater/IPAddressControlLib.dll

.dll 26KB
D300I-CSR011414-BW256B-EN-261023-GD427-Updater/libUsbContorl.dll

.dll 60KB

51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6

SHA256 51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6
MD5 fde725808841019150623a7824af9041
SHA1 9933dbb52ff6f538f72202aeda0476a6f0694084
SHA512 3c489c2e77b80fa2f3b58fe451bb66e5ff67ae4715cf1a3954d53e72f33a9d1911c31224c0d60bca67e0612ffa92ae23539a7f8c52ebab8dd12f6b85fe61f5f7
SSDEEP 24576:VOy6P1FtVBKRqiP/HbIxLs7Pof/0GgEp031xu9XuL2ceey4HwIIpXnFG0c2xTB:VOy6NFL8RDP/kUajgEK31xuR4XyUw9pR
TLSH
T1496533630E530C0AE4E76FDB7EE3E5F80BF92E458D0280D6BC4BB268A97D4785647464
MD5 SHA1 SHA512 SSDEEP TLSH

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/._cache_D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cf0a70575a4a92f70e990dd4849b1d47b7fe5a4dd524f0d3067448a318177844
MD5 76e46667b1530729ee7ce2784f470956
SHA1 a941bbcb337344ae7d3edcd1c8600788c565f37f
SHA512 7b5173ee04956fab0e48a0d987e9d89711091d98201ed48caab00e228577e2e49b53effd08b150009d352ce110ee23cf8387dc88cd2d92fe813e96e3161593ae
SSDEEP 24576:5zorduPKuh0k2PMX+/DmLDzsordZorpy:5gAPKuh0k20u0g
TLSH
T11D25CF40FD472986DB3C867843726EE047AE7D3A9A00D2CD5988B48A1772B435667CFF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

831802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\新建文件夹\2-软件工具及OTA\D300I-CSR011414-EN-GD427-升级工具源码\POSPrintertools\obj\x86\Release\D300I-CSR011414-BW256B-EN-261023-GD427-Updater.pdb

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

SHA256 3d5c2def5b60ff0ec1db5b02b640ae37954cdc06b8d64469fbf37cf65a5a31b3
MD5 bd245ff0a721140894ebc9d2fa1b4217
SHA1 78d872acd6a41b367e91c636262779eb249736f5
SHA512 e25c70a21fd89bd47a15c6f0941a8e93a97f5f21e2896dc8f4a54514174d95b34a4bda00ef37b59c8223d14a9e031ae2082ca74db7b087404a134116bc1cdf89
SSDEEP 24576:ansJ39LyjbJkQFMhmC+6GD9hTzorduPKuh0k2PMX+/DmLDzsordZorpyl:ansHyjtk2MYC5GDbgAPKuh0k20u0gs
TLSH
T11385CF21F6835433D739463C8E67ABA4492E7E352E20E58E3BD83D4D0F3578229265E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/IPAddressControlLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7f16e53bc3c66ecc7d92621291c2c58dead7a0136548920fb3395de8e687aeb
MD5 394d7b7cacba3519ef29d5c624fb21ad
SHA1 dd2192cedf633bc0a70d3e82bc747594e063fb39
SHA512 b928e84db245343d455d38db243edcd8a3713ff9b52d75ad2708b1538006480520888f13e2f92ab9b1c95c10b1477b333a090ad8e799b6b61aade94e7feaae97
SSDEEP 768:ck+izLvz9z0b1ivd+xRdzuP4L/Pu+qsqqe7Oz5:ck+izL79z0b1ivyeC/PuvsqB7Oz5
TLSH
T17AC22B006795C737DCBE8739B4D256010374E287A653DB2F9EF860BE5DBB3684402A6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\IPAddressControl\IPAddressControlLib\obj\Debug\IPAddressControlLib.pdb

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/libUsbContorl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f92cdb7f7971f0fc24949e373015f8d1f6b04f434f429a95217f1262f3b5cabe
MD5 30c79165c58d1c6ec9ba0755b6f85c60
SHA1 5af710092fc0e94c6f2f064dfe50d7e1a41678d5
SHA512 fa3212d211c69dbee7bf077acd4b2402cd7cf87546a76f1190d0852317025c99cf078b541c781c95806be4964c438f195274ecfa4a98471614e15f28046f3d50
SSDEEP 1536:9Fqr93lVbt1bd97+qg3ZYDfP+nrxH/7zWTgz0St:9wX78YfPQ1Hf8bSt
TLSH
T1A5535C60E9562B7ACA49C8BFB0B3060225DA537A60057B3FC5DE829E243DFC11D25DF6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\My Program\C#\修复库兼容win11系统时的报错\C#返传功能例程\DEMO\兼容win11\libUsbContorl（2022-05-10）-最新框架\obj\Debug\libUsbContorl.pdb

51da5a008651878447bad13c1c2132fcaa400a78a27de87532c27eef80c0a7e6

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/._cache_D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

mscoree

dotnet

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/D300I-CSR011414-BW256B-EN-261023-GD427-Updater.exe

generic

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/IPAddressControlLib.dll

mscoree

dotnet

D300I-CSR011414-BW256B-EN-261023-GD427-Updater/libUsbContorl.dll

mscoree

dotnet