Extracted

Extracted

• • Target
    x/X_Attacker.exe
  • Size 999KB
  • SHA256 0ad39860802e556879d212d6094a52d220722bf669f5d35f12bf2e3f3a4361ab
  • MD5 af8e2bc64b2174f6eddd42b5620f8d02
  • SHA1 11f5630d1ead5ca98d6e64a9739e86ee4ebd056d
  • SHA512 6606302364d0944747a8a3a3593a66eb57fae76a64011e2585fd95aafc53c414da4f6242d58f060f1584cc1d02f02d8c62c996f5dcc49f87e965705447640692
  • SSDEEP 12288:EMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ucv0NT64Qs:EnsJ39LyjbJkQFMhmC+6GD9ucvkT64P
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xredbackdoordiscoverypersistence

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2
• • Target
    x/data/Main.exe
  • Size 32.5MB
  • SHA256 46e48a77cab4f26eceab825c7371aa1d1191b48f62df0fc83fe2e3215c18070a
  • MD5 6470f7d065aa4f108c240b4a153c5c84
  • SHA1 64e0b88da4172c1666ddd40c81c3e947bcb7073e
  • SHA512 9a2fdf27455c890b90ebc7b69804826995b4b3b3fcdb9d4c64ab44cbe1761dffbd8f1cdf26d6178087dec7863e81242f1a9e72798f477a6b281af3d20f64294b
  • SSDEEP 786432:HaAVWfpq1QtIJ2j6+s7LWB75zuPNua8DZczW8SeAlem0qK:HRWh2iIJ2qHWB75iVf6yWx1l1t
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral3behavioral4
• • Target
    x/data/boot.bat
  • Size 833B
  • SHA256 0fd0d5a0e7d7e4264e064800166d45b293737f753c58dcce15073171558b812c
  • MD5 89b0c6ee8d688683c261bca0e27ddc5e
  • SHA1 4100992f0755b97fcac6338b0e9d6d8a194a64e1
  • SHA512 e7d950728e5a9c885fad1b5496be8b43e59726f6fd5b2253670269f16c42fa5a4659a38a8dae70b08f96d2b371816694c2514c1f581945ab4f61eb1bad1543b5
  • MD5 SHA1 SHA512

  Score

  7^/10

  • Deletes itself

  behavioral5behavioral6
• • Target
    x/data/sms.exe
  • Size 9.3MB
  • SHA256 0c2e058f82341a8b2b4460cd0bdbf2ed9156295e5e9a64b68aa320b817f2fb1d
  • MD5 2fda729af7be83624fe7b5c61d2d36a0
  • SHA1 68ee34c9d368b0a201f9a574c19fe700974a6563
  • SHA512 869a40de2075764b03720f9a176615a15fd67b69d0e04bdfa1c596f9315ca4aaae1161aadcd1ae47cc23fdb9872e7b7c58f0ee8b00784f2559e3a4664ce2883e
  • SSDEEP 196608:kL6l5BVpPXNxqVOAyfwK3rQOP5WunF7cdeb/C3UwNRaLJJ2jDa7Gw:k2ldIVdy4afBW62duNJ2aT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xredxwormbackdoordiscoveryexecutionpersistencepyinstallerrattrojan

  • Detect Xworm Payload

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral7behavioral8