Extracted

• • Target

    df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe

  • Size

    2.3MB

  • MD5

    e458deafb28333f548c26abb8ab87360

  • SHA1

    0c1fdb03cfc6006c3c698fbfc853d1e9371cfe76

  • SHA256

    df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9

  • SHA512

    eb62aedc33c5a9f48bc9153774fb91f71e2e160fc679f1b7eeb7982c1aab13a8dd206ea51ca39f143b6ed7dcf2660851d43109784639d6adec61bd4ebdaa8ad6

  • SSDEEP

    49152:dnsHyjtk2MYC5GDNYTWPNykHuuSshTypt:dnsmtk2adeoiOln

  Score

  10^/10

  xredbackdoordiscoverypersistenceprivilege_escalationupx

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2