Extracted

• • Target

    cc474b2294467921e1156d5c72461ca57de5bfcd931d6525b3d4bd74150a0d41.exe

  • Size

    3.5MB

  • MD5

    470e9fe6c02e6aa4cb615bb5e27a3901

  • SHA1

    24d99a93454eabbb4fa12358e281daad7969e48b

  • SHA256

    cc474b2294467921e1156d5c72461ca57de5bfcd931d6525b3d4bd74150a0d41

  • SHA512

    2bef2f5dc44e0cd1792dca5c9ca422504ccaddda316f7dddfa1430abb7dc431f404eef92336cfd7d5f2f34715fb9bd1d28a20697462e2d617c15cb580d5349ab

  • SSDEEP

    98304:Lnsmtk2aNXzhW148Pd+Tf1mpcOldJQ3/VY:zL6FK4s0TfLOdo/K

  Score

  10^/10

  xredbackdoordiscoveryevasionmacropersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2