Extracted

• • Target

    1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1.exe

  • Size

    3.6MB

  • MD5

    49587b86bd87a9fb71c8ad078e36b9bd

  • SHA1

    7221a8436832cf30b046be552ad82116f3164ec4

  • SHA256

    1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1

  • SHA512

    b418b4676a155d7edf25bfc8ecf160cdb59c4b2a6d370682a5894a68db5344e9d94b3941790df2ffce37efebb1cdf6862cb1391db335102aabf73872f3724226

  • SSDEEP

    98304:Snsmtk2ajqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg/:cLT405QYtsTEB08T8HehLvU

  Score

  10^/10

  xredbackdoordefense_evasiondiscoveryevasionmacropersistencespywarestealertrojanupx

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2