Extracted

• • Target

    hoaiuy.msi

  • Size

    1.7MB

  • MD5

    251eff52580900a708bc33aa5ac20707

  • SHA1

    ff2848350a329b3fd9d460e40d898962899e5b4d

  • SHA256

    0713f3f1c34297d9689ff5b5202c2f37e385109ce493005eb1128ec180d03afd

  • SHA512

    f0d4501af1d323347aab94eb35c94980fdbade725e7f3e061835cd322ae6333877fb6e0d0ecf73cdebeab40c4fdf1e9acf0c6b5ce85afd51d0a37ddcaf4c7d94

  • SSDEEP

    49152:xERnsHyjtk2MYC5GDIhloJfAAR/sTEsiwg6gpWacS:knsmtk2aFhlZUETE9wg5

  Score

  10^/10

  xredbackdoordiscoverymacropersistenceprivilege_escalationupx

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2