Extracted

• • Target

    1e9ca01052b0b4acbc82b71eb7ce1445e7356eeb9404d529a6c1b47b181274f6.exe

  • Size

    744KB

  • MD5

    9fced1c3eab7b34e214925e885a25bb8

  • SHA1

    e6daaf0725df45794e1e8e654420ac2ea995694b

  • SHA256

    1e9ca01052b0b4acbc82b71eb7ce1445e7356eeb9404d529a6c1b47b181274f6

  • SHA512

    d92f06c78123709755108e3907a2e3f59f204135eb50a1c5f9929373099b5a008c8b5d16b26e506dd143fdf9a7b2caeea46aa81b630b1e743558cb8cdef3e47b

  • SSDEEP

    12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9QU:vnsJ39LyjbJkQFMhmC+6GD93

  Score

  10^/10

  xredbackdoordiscoverypersistenceadwareprivilege_escalationstealer

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2