Extracted

• • Target
    2026-04-23_6b65f9ac93fd4f00966b41200ef59be6_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop
  • Size 2.9MB
  • SHA256 5b918fb11784d20c1de37c579b42a67e122a77ade244a4bdf8cb6466172aed72
  • MD5 6b65f9ac93fd4f00966b41200ef59be6
  • SHA1 d6a8d76eb86559c030bd98dd288a1413e552698f
  • SHA512 461cbdbe84da3071465ef6786ba70f41a5edf0b6e4d6417ec3ba8901778aec5b45975576b84b290e440d84c80c43a67bf244a30b7f9ddbdfe37282e3cae4221e
  • SSDEEP 49152:QnsHyjtk2MYC5GDh3a9626oGnkcmLbMbNZSuLZQ27AJpJ7RVNhooCRFB45AEnyJH:Qnsmtk2aL426oGmLnUzAJHdVNOTKWkcH
  • TLSH
    T1A7E5E032BE919432C46235F88C6EA298A4797E511E64AA8777F43D485F342C3ED3139F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryexecutionxredpersistenceprivilege_escalationspywaretrojan

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies service settings

    Alters the configuration of existing services.

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2