Extracted

• • Target

    3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d

  • Size

    1.2MB

  • MD5

    0de4333f75d28ab023f56e208ea1f4f2

  • SHA1

    7edd7e6ce18728cbe132c256bbdc51a7b24002d5

  • SHA256

    3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d

  • SHA512

    d8c0cf967227837f9d49dd271e99c408d63909cc954074dc21f1fb788bb5bf1bccd9e5a1b7c997b2373b35ff0897fe43bcd3221e38a708642a14493a6271e54e

  • SSDEEP

    24576:oGl/8l+k1W0tq78x3s+hPNt790/ASMcmqhrbjXxI+PpKWSJTzCduD:Ll/8l+kAf78x3B2ASMHKrfPpATz3D

  Score

  10^/10

  xredbackdoorcredential_accessdefense_evasiondiscoverymacropersistencespywarestealer

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2