Extracted

• • Target

    g.exe

  • Size

    106KB

  • MD5

    f52a1ae522be2d339ac6a8272780ad38

  • SHA1

    cf6d8643f690eafe02c1e29861ab687cf8270ca9

  • SHA256

    68178b1f58efb2930e9153ec8697f09bc35bc479314adb0db8f199e0016fe749

  • SHA512

    44e3d79dc7f128c7548a255674827b948f78889d1d063e90b0e9a8fc4cc4463aec50176c577888d1c5034f80a02e7440110c72d2fb47dbd0368a932f5caa0168

  • SSDEEP

    1536:xxuiX2rv5jlwpxJbjrHbgvSAtdHxYSF739z98sW/do9dlzpvSvQfJZ:z4elzHbcxtxxYqr9pI4jvSvQfr

  Score

  10^/10

  xredbackdoorbootkitdefense_evasiondiscoveryevasionexecutionexploitimpactpersistenceprivilege_escalationpyinstallerransomwarespywarestealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Possible privilege escalation attempt

    exploit

  • Drops startup file

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1