Extracted

• • Target

    4b9a374c136502529bcafeb728a58a27bd0407fb839add8276fbb15004b50ed3N.exe

  • Size

    2.6MB

  • MD5

    525b2fd46d2aebd8acb6bd4200c79c70

  • SHA1

    f792a76e6223fabbef5060c8e4fd80cd16ec061d

  • SHA256

    4b9a374c136502529bcafeb728a58a27bd0407fb839add8276fbb15004b50ed3

  • SHA512

    4d658a6c3b822c45d8ecaafffd400bf21295703020b61a1a0b57d04a0e1cdc16d7d72bd378d1bee8d44952cd687c83bb6a4e2e6d65c25104a87aa9b6a4d8f04d

  • SSDEEP

    49152:gnsHyjtk2MYC5GDnYolY+iOo7/PpGpL0oh6jgvZ:gnsmtk2aDoCOqpG1fh6jgR

  Score

  10^/10

  xredbackdoordiscoverypersistenceevasion

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2