xred | 37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0

Sharing

Copy URL Twitter E-mail

General

Target
37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0
Size 609KB
Sample261105-d2z7kafe22
SHA256 37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0
MD5 9f9852c68f8a59388c7484ae0ed1f914
SHA1 ad28daa630d4243b193c617ed37c92c51902359b
SHA512 72574e86a594c8efa436573fdb8112266165816713049c706267e7047294681ebab9ba87bf3d09edae3a585cd87fb7b025054b58ee1f3e54e6a115bea0e24b2c
SSDEEP 12288:Pi1ucQZFep2AX3Pi6cvlE+xMeMc7O2wB76zEuSrS+Rf4EqWzuTEfSHSR78b:PdcQLnQPGvlE+x7H7fS76AuSFHqgiSRm
TLSH
T1A9D423ED98D1284BC646BCE27DB84842985F55F3F387F8BE3740914A2F5E089E135A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  08th/workout/20260450441-李宗轩-员工信息表.xlsx
- Size 13KB
- SHA256 fe3bbf6e268e68c3b1a933216641aca875b02b8fae3a3b20d71419a6b1ec9339
- MD5 a1257e5199a883236e8b38ad9a189104
- SHA1 a8f6f1673859c695675e3cedcbadae72337e5a8e
- SHA512 ac14ee2b55fed2e52d91fd2a377c49fcbe77964cc74c21065f7643366901378e6876d93dec5bfa428c7f30c35c81bcd0b7a799c948cd0da1f0bfbd048261a67a
- SSDEEP 192:kRgsitUEo9vlkbpCPqftMJ4TXPGkUlcB8/YLnrdJxd2mW7Hfh8SnG8+05aYDR37D:uQtGlOCsMifiU8QTx0mAfh8SnG8mOLv
- TLSH
  T13D527C3D8606AE58D2774C7DC00C12E7A78635409121AD8F2990F44D3F74A6BA78F7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  08th/workout/20260450441-李宗轩-往来客户一览表.xlsm
- Size 19KB
- SHA256 17e6f40572e761aee75034e836d34ac3c70dfd316c92317821356be86824c42a
- MD5 ff22482f755235a412564a21e7b9790b
- SHA1 6160abe7c2ecc08b0d558d0779cd33eb022eb5dc
- SHA512 53a11e2c8ac45bf423b44ea3f6262e91298398b8e30e6a7bbfe83348e21a59dbd84f896bdcf0d56d80afc2542d7d10626cd077f39e9396a8fac9672dbe3de4ef
- SSDEEP 384:Ls/nMe9l1V6NgPszgt2KCWUJl/PZa1htLz8RiYdbG8xTlBXSVM9:0R9lna6LcwtW7dbG8xz/9
- TLSH
  T1BD92B01FE3C1B856C6A7987D416800F3DD49A4A35206B24E3A8CBB4D2754FE7178F2DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  08th/~$cache1
- Size 753KB
- SHA256 458b41eb36127e1ab9cfa3031d596b8f302affa9a895844737962f210a971262
- MD5 f9365d16f887dc514ad12bc30c8a51f6
- SHA1 7cb45addfba52cf741f55def9b77db18a8d96fc5
- SHA512 6b1c190aa4ba7d1c524985704443be70fa6a3238da1e48c0c414205d99f1827f01992b0485cf3f210e60c655c4100c9041dc2fe4660421608f3dfd98a23cc421
- SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Idr:ansJ39LyjbJkQFMhmC+6GD9e
- TLSH
  T174F47D32F2D19437D1721A3D9C5BA3A5582ABE512E38794E3BF82E4C5F3D68138252D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral5 behavioral6
- Target
  08th/任务1效果文件-员工信息表.pdf
- Size 43KB
- SHA256 860eabd9917d0d082b77a6f3cbd85ecf7feb38d82a8e9824c83c576f7ecdb05d
- MD5 7edcc6a4865f9307813da50be4fa0425
- SHA1 d133d9512dec8e13b34a80b4e9827fef56f3b11f
- SHA512 0a41df0e1e55ed1f9f39a822cfc1001e7c1aec8cb06d0791ab7d9391c1d9780c4802b4edc795e1cbd5ebafdd5d43bb2ad40a9ff15dfd6ceced9fd185cdb7dc11
- SSDEEP 768:Rvg3sowYsQoZuL5HyKGKIi8FlIXiBgtXE1bEFMEw7tQZkC5tLwufjZQ6X5SBY:Bg3aHQocVShKd8LI3tiEaE2quCHwufv7
- TLSH
  T1B513D04ADB9DF80AF082101BA6257ADD118B7D2B70E0CAC622F457DD1E57F2B4B70C82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  08th/任务2效果文件-往来客户一览表.pdf
- Size 61KB
- SHA256 661531411ae8f43b12fdfca2dffd543805d0dbc36eaff7c48acc9ad9ccf7856d
- MD5 68bd34e35936af703da8020d5f409b0e
- SHA1 cada1679a46a6e397eb22817cdba6f1fffc56523
- SHA512 4f933c38e4ae2f08f0a0e910cbddf05078d3d38c7b8f94a993f72e46e8bf55c22a174582565695930f9cb6614fbcad39d12753c3ea16fa89334ea984727c1dff
- SSDEEP 1536:8B17bvgGeWEBRAKefwJLuKcMWPFLB1hWTt4OOQrnHMO5/:KbvgWEBRTHCuEFbk/HrnsO5/
- TLSH
  T1A153F10BC5D50D64F7BC0306F3921995868DB14AD9EA86A01BA6980DC4CDFE9EFF2D1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  08th/任务2素材文件-2023年往来客户名单.xlsm
- Size 16KB
- SHA256 f217888a61125e530bed19777a1a05c7a525662478185f2078eeb6c256770dc1
- MD5 174dfbe2b8fc5b3a90885c990514390a
- SHA1 2f22811dbf6d56de5d7ef4f4b2c78d97a41ef10c
- SHA512 04f6e4e196a59fc91d0765fa65f2433a3b80ef9981fd2333586a09818144a10ebeaca3990ab6fa4a9b2da5d862cee2501036e052e77a4cece1318d0586dc8362
- SSDEEP 384:M1lpUtPzVE1cx8FHCYqhnkvG596hg2bsFqLVo+qPm:M1vUtPzfx8FHghkON2b3Vow
- TLSH
  T196729E35CD864436C32A72F996594747937FB2718203DA492C9B28E42C47AFC0B9BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  08th/任务2素材文件-往来客户一览表.xlsm
- Size 16KB
- SHA256 8b57152e3bd8a617ebb5aeb60a42a53203036e52caed5b7ecf5d79605fab8499
- MD5 50267bfe4918ac0eab0de941ed898798
- SHA1 f84990c72acaf6658fb9e6702db8740d2e4cb426
- SHA512 ab38527f048f7f7c04715adbe10aa11c93390bb7af6b7b6e9991a6e59ade0cad4c1a8627801477ed09ded6ebfde97cb9908116c3cfab57485b5f4bf2373102a0
- SSDEEP 384:zaHpbEBsbhpjC7ejUHaT0yiYHfHCG51gHS1oiXFWPcWBqPW:anbhpMejVtHfLjiuVo
- TLSH
  T1F3728D29D7544824D182A2FE531A174BE33FB16043A7FACD2E6D15E41D838BC2BAF91D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  08th/第八次课-任务1员工信息表实训任务卡（学生版）.docx
- Size 61KB
- SHA256 b09f8ceb2b3bee4889e89e196564b2ffb1a6ae43f6031994a75606f5e2bff2da
- MD5 e04e000a5da4a2a0aa4c269785b31085
- SHA1 171326224aa2aa787e29e5217d6a4c1d2bb5afbb
- SHA512 5a100c615595943d51472d2c83505cdc8182bb9eff64def145f31465d06befd11b6c367f36d56cc07e1a7f29e6e14dee93c26ab90801e8e456588db1ce065da8
- SSDEEP 1536:KWYmKjyxSlLDVsVjlcIcZuyxxUpg0sOOrL3C:XYbOCDK9sxUpDA3C
- TLSH
  T10A53F1B9CD9D116FD296FFF5801C4F2DAA3EC22D9568FA033C8E90CD5162439189AD8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Xred

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16