Extracted

• • Target
    2026-06-28_4ee59a4485c6c7b82643a24bacd2a63c_dark-comet_darkgate_elex_gcleaner_glassworm_magniber
  • Size 5.0MB
  • SHA256 7f97c7d7bdc1324d2a460ca6979510818556aab96c3e83bc149ee68391f14a50
  • MD5 4ee59a4485c6c7b82643a24bacd2a63c
  • SHA1 9051fdac3773b596280bf75fdf089639acb1bfb4
  • SHA512 fc211aed188519591a217eacf65b0e5e149be0bd9575ccd6366f3997f6dde83d89d38b7b5bb9b01f07518b1acb497da38e41dc94f2f79244caac5110a1ed1334
  • SSDEEP 98304:6nsmtk2aeiAl1PQMXzjvZHSMO035ArsfQBFPZxa7rBwDhfaigIfp7:0LHiAljbEMO0MWQPDhye7
  • TLSH
    T17B360121B2C0C036E97315B58DBE9ABD886DBF901F2425CBA3C8CE5E4F759D2653118B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryxredpersistenceadwareransomwarespyware

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2