Extracted

• • Target

    OneStopShop.zip

  • Size

    11.0MB

  • MD5

    08c3f994392c991d7a23c435ddaf6e70

  • SHA1

    3cf30490ccc7321a204f627861772f64201a2c54

  • SHA256

    b348bbc6e7e76bfdaf053e6df3eb41f5dddce5049cdbda65c1b7386fcc183392

  • SHA512

    fcd2e657ec9354facb1c6391f1a376ccf769be2a22e6fd4168c9c9556bfc42afe29288730d123980e5f41f9096b3a02849e7ad4f1cc8106dc1789339eb6996ba

  • SSDEEP

    196608:LI25YglEcfIDz3KcGRCxirftcTaJqcb85EEOEidunmzoftvbW4nh2nDkWimDkm7W:3D0RGRffIWwmcTK4W9vR4I/QnGwGU

  Score

  10^/10

  xredbackdoorcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealerupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1

• • Target

    BoostTool.exe

  • Size

    10.6MB

  • MD5

    cb598ffa05078fd9ee2ff6b1b52d9d34

  • SHA1

    31fcc9e65912072aac8e14c6bd87aad7d06133b6

  • SHA256

    2db90eb0a3f229be32d32b949b3aa715c66d7525dc6b50f0d744a677bfbd617d

  • SHA512

    3cad964a7fe44e466a0a9159610f4d232bdae811ad9624918b8f57243b42f1d8dea9ef526b977976b7068877963183625429e90252c2378d16f04ce6b40a9c8d

  • SSDEEP

    196608:+IY6xgFW1A9/UD1zJwLUf6WPvC1kD9ayyJXsZYaEK0bOPMpy5NxHAa3hqPF6kqau:Z2J0CLC6wvRm1+0kJ+Ek7RbcCvo

  Score

  10^/10

  xredbackdoorcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealerupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral2

• • Target

    Data/Avatar/logo.png

  • Size

    225KB

  • MD5

    740c4d360d784747ca418ae980bd9ee9

  • SHA1

    535b6b153ba1f57d27298f132442b72beadc7737

  • SHA256

    a64c47bf9bda46ada462443471921400e60d98c94219e8db9244b72d6ddfc268

  • SHA512

    0c5b3ad5db336f74c7c40d4c39b694b44fcd3decdf82539c0970d3798ebddbe7813f02f3cca783e68933b580734159fd7d9046d84164a4c7b155ea51a3cfbc79

  • SSDEEP

    6144:xmPLyQHQgYNRSHZhKNwKMh1bWPBHNS+vuZLy:xmTyQ7YNRSHZhKNJMuZtScuZLy

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral3

• • Target

    Data/Banners/logo.png

  • Size

    225KB

  • MD5

    740c4d360d784747ca418ae980bd9ee9

  • SHA1

    535b6b153ba1f57d27298f132442b72beadc7737

  • SHA256

    a64c47bf9bda46ada462443471921400e60d98c94219e8db9244b72d6ddfc268

  • SHA512

    0c5b3ad5db336f74c7c40d4c39b694b44fcd3decdf82539c0970d3798ebddbe7813f02f3cca783e68933b580734159fd7d9046d84164a4c7b155ea51a3cfbc79

  • SSDEEP

    6144:xmPLyQHQgYNRSHZhKNwKMh1bWPBHNS+vuZLy:xmTyQ7YNRSHZhKNJMuZtScuZLy

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral4

• • Target

    Data/Output/[nigga] [2024-10-01] [2x 1 Month]/Failed.txt

  • Size

    1B

  • MD5

    68b329da9893e34099c7d8ad5cb9c940

  • SHA1

    adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

  • SHA256

    01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

  • SHA512

    be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

  Score

  1^/10
  behavioral5

• • Target

    settings.json

  • Size

    708B

  • MD5

    8c2156c75bce66d2a127253d89d4e79f

  • SHA1

    8277586c8f3f9d38e819a5266c4a935386ea782f

  • SHA256

    8a6f038eb95031a66b34c9ec4b69ad091a8c75b8716fb42ddf6dbee6c73b1c76

  • SHA512

    334aff4e0cd7cd1b75668a0fb3e8ae0519172285196a8ce72c421e5bc9a1bee8807ed94637a6bf00dcfdf9e763002470de1593fccbcbeb6e19edca8a2ad48880

  Score

  3^/10
  behavioral6