Extracted

• • Target

    90525c27b1aaf55a465127b8fc26818ecec0c1fae0962d39d9d9c3ab81d13904

  • Size

    3.6MB

  • MD5

    c2972d792053690ef2691934ceaa9c3b

  • SHA1

    ed118d6e81af163e6596d31981a594b334efd7eb

  • SHA256

    90525c27b1aaf55a465127b8fc26818ecec0c1fae0962d39d9d9c3ab81d13904

  • SHA512

    fec10ed87dd11db615e752f338995dc482a46bf2a5b0337bd9e30b67e9cbbf1f6e061665f79ee5f920e960af0312b34cc16de6ef10e456be0400e117518f7695

  • SSDEEP

    98304:5nsmtk2aKXzhW148Pd+Tf1mpcOldJQ3/Vk3Y:FLtFK4s0TfLOdo/d

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2