Extracted

• • Target

    zhuzhu.exe

  • Size

    5.8MB

  • MD5

    675f03db23d403573a3a6f708a0e4369

  • SHA1

    78ee9afafe6bf18d2c42d816629b6f9ed1e3ea2f

  • SHA256

    ee4c8a187e1e1bd62abe49faece1f327dc7718c736dd1e427c025d73fa796cf8

  • SHA512

    c9055873fcbcefd7aeb8414627d4aa7645014bc2a609a4993317a45465a2ffdbeb38dbfb6c7677350203fe1e7d1f3906fc670ae74d1a75fbd91533044f513240

  • SSDEEP

    98304:unsmtk2asgF0ET9HlrxRVwJMACNiREvBvlvwvCvxvD:wL8Z9HhxRVwJMAqoetRqA9D

  Score

  10^/10

  xredbackdoordiscoveryexecutionpersistencebootkit

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2