Extracted

• • Target

    7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe

  • Size

    2.9MB

  • MD5

    7a1a9085e0f549ec511d7d2663099c70

  • SHA1

    3b21d3dbc01758bd15fdaab3e3c51513436b6a46

  • SHA256

    7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4

  • SHA512

    3f0561bcc0583d5b8d68f0666f5de1676e8dbaa817720519a25fa014cc46715ed6c3f2928b976c0e6ab0558939945e6478292a0936f5695d344f4ca58dd6c245

  • SSDEEP

    49152:RnsHyjtk2MYC5GDiYBnsHyjtk2MYC5GDTYdnsHyjtk2MYC5GD6Yx:Rnsmtk2a0Bnsmtk2andnsmtk2aox

  Score

  10^/10

  xredbackdoordiscoveryevasionpersistence

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2