Extracted

• • Target

    f7387b4786b8bea31862a530138090626a467b39a9c1e7e082d1a6fa7fa8ad52N.exe

  • Size

    3.5MB

  • MD5

    87e6c698376f457fbceef44ed48c5380

  • SHA1

    7293e881ca722da9e024f1053280514e56c86a37

  • SHA256

    f7387b4786b8bea31862a530138090626a467b39a9c1e7e082d1a6fa7fa8ad52

  • SHA512

    1980a37a795b93a2e10f86f990ea2b4ab583642903ef31b4c8c034d1f3b95a22492cf47beee3234a5e2c29438de76522c247455903a0718dbf16121d5cf035ee

  • SSDEEP

    98304:Lnsmtk2aNXzhW148Pd+Tf1mpcOldJQ3/VY:zL6FK4s0TfLOdo/6

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2