Extracted

• • Target

    4b07f194b3dec3f31d74bf45b445502f79bd76956c5cb2e4c30eea0aa0efeecb.exe

  • Size

    2.6MB

  • MD5

    0114727c340e4ff952938ff19491b098

  • SHA1

    72bd39f695b9580c76382e5d91b337f27c951dca

  • SHA256

    4b07f194b3dec3f31d74bf45b445502f79bd76956c5cb2e4c30eea0aa0efeecb

  • SHA512

    43047984f8f8a391133194d7d203b2e5efb55410abc7e8faa057c2b7695513963a28bfb822775d68263934f20b2c8b73d43a4dc67208329e4d435f6e2ef9a4db

  • SSDEEP

    49152:gnsHyjtk2MYC5GDnYolY+iOo7/PpGpL0oh6jgvp:gnsmtk2aDoCOqpG1fh6jgh

  Score

  10^/10

  xredbackdoordiscoverypersistenceevasion

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2