General
- Target d7fffc17a37988c2bdeda0967563223b41f6213d5b9f6ff3009d6581eafbaccb
- Size 411KB
- Sample261104-hhx1bacf95
- SHA256 d7fffc17a37988c2bdeda0967563223b41f6213d5b9f6ff3009d6581eafbaccb
- MD5 f53524118ac966f52dbcc2c444152b2d
- SHA1 0a44a6d0e6d3625d622088a3c9842ea4498182bc
- SHA512 5d247fcad519d0edf43c90a9d2d294ae070a92e84ed513dfd529c6649ac79555ceff529d5ccbf8e3d174316678866a832f57dd6bb32e02c8a6b2203a6bc87bc9
- SSDEEP 6144:aDbgzoaFYhIc6/NWFg7v3rdIiUjnmZRJSGhusb5eor7eA8YE4tJPpIm5BhsnOX:aKeWcevb+iUjnmZRMG0sljX886ymOX
- TLSH T1C794233B2A6A154E91C17DB3B002265A38C794B23D69FF6B2585371EDF10DA6BC73850
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
中兴PM宏录制工具.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
中兴PM宏录制工具.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Targets
-
- Target 中兴PM宏录制工具.exe
- Size 821KB
- SHA256 81366f455e552b34ccac859249b370c4b83dc9cacb16c13521481133c174a145
- MD5 153f2a15838f4605e597f4e5972044ee
- SHA1 08f804ff2f11478d7b2aa5beead255bcb6bebcdd
- SHA512 25c966bc3b83ac31c989792c48f0d1314e910ea40e5ca1893c55c121d1796befcef8d26114c6a309a75a1f0ee1ab033ed06864de7336f141331fb0ee06980b01
- SSDEEP 12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9PcuU29j:xnsJ39LyjbJkQFMhmC+6GD90s
- TLSH T1C8057E22F6D14437D1721B3D4C6BA3A4593ABE513E38BA4E3BE91E4C5F3E68128152D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Adds Run key to start application