Extracted

• • Target

    valyzt.msi

  • Size

    1.7MB

  • MD5

    53614b87538306b4f7437db8be2a0e47

  • SHA1

    a6a777b24bb64067738386caa66787b8ed225726

  • SHA256

    e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8

  • SHA512

    cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1

  • SSDEEP

    49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT

  Score

  10^/10

  xredbackdoordiscoverymacropersistenceprivilege_escalationupx

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2