Extracted

• • Target

    90d7154ab0eb04f847f661b17d421142930528bc8e1484e2bd7b7fe51d11254f

  • Size

    3.5MB

  • MD5

    ebc8627852b666e23093d0e2866a3541

  • SHA1

    c566deae49e311cab73f4c46c52cc007773a2677

  • SHA256

    90d7154ab0eb04f847f661b17d421142930528bc8e1484e2bd7b7fe51d11254f

  • SHA512

    4c7c3a94e107ebb7d25e677b5e81f90a81bdd1316d8aedf38a09b709ed7890653732d5e32b356a0367f7d800f736f891692aa3185e30ffe492a50db0320717a1

  • SSDEEP

    98304:vnsmtk2aw++l1Nph+3DnftLxTS4YNukVD/z:/LFvh+3rFLxTiYc

  Score

  10^/10

  xredbackdoorbootkitdiscoveryevasionpersistencetrojan

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2