Extracted

Extracted

• • Target

    155b933fb9fe44c971a042e6539d8544616f908960177e7922eee1c943008ab9.bat

  • Size

    41KB

  • MD5

    a2539089ecc2f92f81908c88ab2b2938

  • SHA1

    9a18b58b8fc22ec070434020c537f4bfa5c57973

  • SHA256

    155b933fb9fe44c971a042e6539d8544616f908960177e7922eee1c943008ab9

  • SHA512

    07a1a04a25c9063e8ba14b516b768906b115ae21d1133f01f8f4b7674e512bd876a5109d26aa1d78d91cbf3e7c9c730d6921f6cd95ab0ff5a5f58331a17dad40

  • SSDEEP

    768:OfxzLnYe9TQ7lOYSeIAeIF3k54J9Ti1KcTtb2w80P+RTXH7hhb:qxzLnYe9TQ7lOYSeIAeIF3k54J9Ti1Kx

  Score

  10^/10

  discoveryexecutionxredbackdoorpersistenceupx

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2