Extracted

• • Target

    2025-01-18_b76bfc78758d62cf93684f1f65c7dc65_luca-stealer_magniber

  • Size

    12.1MB

  • MD5

    b76bfc78758d62cf93684f1f65c7dc65

  • SHA1

    21901739326632e713402ff4b95acf15c654ac72

  • SHA256

    ca83449aaa9d3b58df7da2fd3c7394539681f95af0fc77da66f73c7badd00adc

  • SHA512

    f4c23b40e6e754ecb9a4863fc78635c4bd770ff66f5e6402fd629c31885a1bd629f9f6685cd78d6a58cf410234c987dc0ca083040727d2afde5162f16cfe5378

  • SSDEEP

    196608:uLg1DvcnC6lfYI+awwhq5FdsbOcRZO6Q55CfSzCfKXFR5a4t3QXZuXc1o9yaaI64:u6DvcnC6ld+a9MCCcRZO106Wf749yu

  Score

  10^/10

  xredbackdoordiscoverypersistence

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2