Extracted

• • Target

    71ed567d690dd83de676f2a897a362794642d64d7d3e06960f1d09d43f2a97e1N.exe

  • Size

    4.1MB

  • MD5

    87c85bf6a20d7dcc35b94983378f5280

  • SHA1

    2515d5eb4479d82338ac8b6da2d7f30a2c8c4f90

  • SHA256

    71ed567d690dd83de676f2a897a362794642d64d7d3e06960f1d09d43f2a97e1

  • SHA512

    1e3b604f5273cd81eaaf827b605a3c919b154ef3986606b65c9c8a725d6be2b79b550c71d807979a56cc120d8ed3bdf231b9e7fdff7a09d9103b9031f3c5cde4

  • SSDEEP

    98304:Vnsmtk2aEXzhW148Pd+Tf1mpcOldJQ3/V11v3jypL:pLnFK4s0TfLOdo/HV3epL

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2