Extracted

• • Target

    2a35078ec0d7fd71726e92e9f8c2c2614bea1843e5000e37c9ba5792ab5f249f.exe

  • Size

    1.5MB

  • MD5

    541530d085f95820042277daebb1f623

  • SHA1

    31d4b8fc956c9436c114e53524b0d80e8e5dfd4c

  • SHA256

    2a35078ec0d7fd71726e92e9f8c2c2614bea1843e5000e37c9ba5792ab5f249f

  • SHA512

    305724ce531d1b6b4cf8739a10d32551334e1a1e712790839c9a81d51cc5496e1f76cd28d9a680bcc251a795739c5f1a3471e2583005af53925fb47c0c77dbd7

  • SSDEEP

    24576:ansJ39LyjbJkQFMhmC+6GD9u5xolYQY6dp7gAVKzarL:ansHyjtk2MYC5GDjYmp7gAVKS

  Score

  10^/10

  xredbackdoordiscoveryevasionmacropersistence

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2