xred | cdfb2f1b616275557e0f01380e37fe0757a32d6a437b035074ae99e1ad4ac83d

General

Target
2026-06-29_e850a57c5c3604aadbe5741bbb45eeb6_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.8MB
Sample260630-cemsaac16r
SHA256 cdfb2f1b616275557e0f01380e37fe0757a32d6a437b035074ae99e1ad4ac83d
MD5 e850a57c5c3604aadbe5741bbb45eeb6
SHA1 413f1582b30911d17a216c008ec3aa285d8508cb
SHA512 b3627cc65e5c7009b5fe8265d73b88262b88766d80ddfd3b01f819d869845fb465a5ef1a7492222b01ba30d1bdaccd2d97c474da37712b01ba83bcf0fc008174
SSDEEP 24576:MnsJ39LyjbJkQFMhmC+6GD9G/RB4fnffmWNmXXR7WFRjqtPWGCPaG:MnsHyjtk2MYC5GDIB4eEoZ6RjyWa
TLSH
T159857C91FAD344F2E4A30579588BE36F093576114C39DDDFEBE82E8CEE336512818296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-06-29_e850a57c5c3604aadbe5741bbb45eeb6_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 1.8MB
- SHA256 cdfb2f1b616275557e0f01380e37fe0757a32d6a437b035074ae99e1ad4ac83d
- MD5 e850a57c5c3604aadbe5741bbb45eeb6
- SHA1 413f1582b30911d17a216c008ec3aa285d8508cb
- SHA512 b3627cc65e5c7009b5fe8265d73b88262b88766d80ddfd3b01f819d869845fb465a5ef1a7492222b01ba30d1bdaccd2d97c474da37712b01ba83bcf0fc008174
- SSDEEP 24576:MnsJ39LyjbJkQFMhmC+6GD9G/RB4fnffmWNmXXR7WFRjqtPWGCPaG:MnsHyjtk2MYC5GDIB4eEoZ6RjyWa
- TLSH
  T159857C91FAD344F2E4A30579588BE36F093576114C39DDDFEBE82E8CEE336512818296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution xred persistence macro
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Custom signature
  
  Detects executables containing possible sandbox analysis VM usernames
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2