xred | 37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0

Sharing

Copy URL Twitter E-mail

General

Target
37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0
Size 609KB
Sample261105-d2z7kafe22
SHA256 37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0
MD5 9f9852c68f8a59388c7484ae0ed1f914
SHA1 ad28daa630d4243b193c617ed37c92c51902359b
SHA512 72574e86a594c8efa436573fdb8112266165816713049c706267e7047294681ebab9ba87bf3d09edae3a585cd87fb7b025054b58ee1f3e54e6a115bea0e24b2c
SSDEEP 12288:Pi1ucQZFep2AX3Pi6cvlE+xMeMc7O2wB76zEuSrS+Rf4EqWzuTEfSHSR78b:PdcQLnQPGvlE+x7H7fS76AuSFHqgiSRm
TLSH
T1A9D423ED98D1284BC646BCE27DB84842985F55F3F387F8BE3740914A2F5E089E135A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/08th/~$cache1

File Explorer

37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0

.zip 609KB
08th/workout/20260450441-李宗轩-员工信息表.xlsx

.xlsx 13KB
08th/workout/20260450441-李宗轩-往来客户一览表.xlsm

.xlsm 19KB
08th/~$cache1

.exe 753KB
08th/任务1效果文件-员工信息表.pdf

.pdf 43KB
08th/任务1素材文件-员工信息表.txt

2KB
08th/任务2效果文件-往来客户一览表.pdf

.pdf 61KB
08th/任务2素材文件-2023年往来客户名单.xlsm

.xlsm 16KB
08th/任务2素材文件-往来客户一览表.xlsm

.xlsm 16KB
08th/第八次课-任务1员工信息表实训任务卡（学生版）.docx

.docx 61KB

37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0

SHA256 37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0
MD5 9f9852c68f8a59388c7484ae0ed1f914
SHA1 ad28daa630d4243b193c617ed37c92c51902359b
SHA512 72574e86a594c8efa436573fdb8112266165816713049c706267e7047294681ebab9ba87bf3d09edae3a585cd87fb7b025054b58ee1f3e54e6a115bea0e24b2c
SSDEEP 12288:Pi1ucQZFep2AX3Pi6cvlE+xMeMc7O2wB76zEuSrS+Rf4EqWzuTEfSHSR78b:PdcQLnQPGvlE+x7H7fS76AuSFHqgiSRm
TLSH
T1A9D423ED98D1284BC646BCE27DB84842985F55F3F387F8BE3740914A2F5E089E135A1B
MD5 SHA1 SHA512 SSDEEP TLSH

08th/~$cache1

SHA256 458b41eb36127e1ab9cfa3031d596b8f302affa9a895844737962f210a971262
MD5 f9365d16f887dc514ad12bc30c8a51f6
SHA1 7cb45addfba52cf741f55def9b77db18a8d96fc5
SHA512 6b1c190aa4ba7d1c524985704443be70fa6a3238da1e48c0c414205d99f1827f01992b0485cf3f210e60c655c4100c9041dc2fe4660421608f3dfd98a23cc421
SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Idr:ansJ39LyjbJkQFMhmC+6GD9e
TLSH
T174F47D32F2D19437D1721A3D9C5BA3A5582ABE512E38794E3BF82E4C5F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

37a3d35aba6097665b0bcd84bb729ac104cc451aac840090318eb7e8b8b98fc0

08th/workout/20260450441-李宗轩-员工信息表.xlsx

08th/workout/20260450441-李宗轩-往来客户一览表.xlsm

08th/~$cache1

generic

08th/任务1效果文件-员工信息表.pdf

08th/任务1素材文件-员工信息表.txt

08th/任务2效果文件-往来客户一览表.pdf

08th/任务2素材文件-2023年往来客户名单.xlsm

08th/任务2素材文件-往来客户一览表.xlsm

08th/第八次课-任务1员工信息表实训任务卡（学生版）.docx