Extracted

• • Target

    805c795be5f0324f0e1d2bca61beabaf1d1d054eca2ad0224588295bb9d41299

  • Size

    3.3MB

  • MD5

    e3a3e6d5bcdf3fe8c6c525429e401b1f

  • SHA1

    a1b2370bd81715b63dd6268e301a7101d39d3ebc

  • SHA256

    805c795be5f0324f0e1d2bca61beabaf1d1d054eca2ad0224588295bb9d41299

  • SHA512

    be86d4785df2de0b0f4e74c9f56988d7df0dc6ed2bd2d2632b83266a73ed72491b50a3db557d83ce5cca65ed1b98c97d6c63a90045188896b02d2fa3484e8743

  • SSDEEP

    98304:dnsmtk2a9XzhW148Pd+Tf1mpcOldJQ3/VL4:BL6FK4s0TfLOdo/K

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistencethemidatrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2