Extracted

• • Target

    db9fae14fff980af1185980403e8e5c65d757ebbf02732d1c46a9668898256f4

  • Size

    980KB

  • MD5

    a98bb278468370c572610865052def56

  • SHA1

    b3f61627939e0899cf0208d8070e4a38e625bb06

  • SHA256

    db9fae14fff980af1185980403e8e5c65d757ebbf02732d1c46a9668898256f4

  • SHA512

    87cf147589b1005891d78ea07f6596b3094d29b2fc812e63622f98f38ed068e02491ce143cc68b93a9015361f2e913f85b8edefb05b52bbd5c535ffe10e5aed1

  • SSDEEP

    24576:nnsJ39LyjbJkQFMhmC+6GD975xolYQY6+I:nnsHyjtk2MYC5GDQYNI

  Score

  10^/10

  xredbackdoordiscoverypersistenceevasion

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2