Extracted

• • Target

    f1c82a831b4dbcc5869fe60ea8879f073902d358f80b3525fa2682a895715730N.exe

  • Size

    1.5MB

  • MD5

    92fc1b64d702ebee25b1cabea2a81ae0

  • SHA1

    1d3d5ec151eae49d8186d755db49c0d2b1df1a76

  • SHA256

    f1c82a831b4dbcc5869fe60ea8879f073902d358f80b3525fa2682a895715730

  • SHA512

    ac8ad02121c75db44ce5c67c4e7ec7cfdcb2fdcb5577c2675d8c7c63fca27c86626ee45e92c8ec58efedfb35bf9e863b76d482e45eb4dd1427b9a88c73e1981d

  • SSDEEP

    24576:ansJ39LyjbJkQFMhmC+6GD9u5xolYQY6dp7gAVKzar5:ansHyjtk2MYC5GDjYmp7gAVK2

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistence

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2