Extracted

• • Target

    6df4d2f3708e6c56adb14bf17255abbdac61830549424fb443084775ad68afbb.exe

  • Size

    3.1MB

  • MD5

    87fb4257cb0773489cd1ef55238c8045

  • SHA1

    36a40324575abb231d4f6f7db0bd8c7f8682a1cb

  • SHA256

    6df4d2f3708e6c56adb14bf17255abbdac61830549424fb443084775ad68afbb

  • SHA512

    5fa362502c546c84204e7a525256adbcfff999fdf3a1bd0cd9c1d289c6f169d63b81ce17dd19117b78dc9282cb31f1fc729edb87e0fc5e6947bb8d8131c85603

  • SSDEEP

    49152:RnsHyjtk2MYC5GDfL0UVAhJtZjwhf+3KlVahOfe3ax+UlSa4MUkPEwBs2b0Rr00:Rnsmtk2aAL2hTZchf+arfeqUTMRPBGhh

  Score

  10^/10

  xredbackdoorbootkitdiscoverymacropersistenceupx

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2