Extracted

• • Target
    2026-07-02_60f73f2e8ffc2f28d058cede05fe1430_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry
  • Size 2.3MB
  • SHA256 d8cfd6e0d9a9ce20ac048dbfea3406c6ba2e96356c9f11e05496cc31e9ca8acf
  • MD5 60f73f2e8ffc2f28d058cede05fe1430
  • SHA1 0164435f8e1952fec8319d724cd50bbf06150773
  • SHA512 41ec4b151a8ed676fd7465e1a7d7639d433b956ef4ac309d4a0ae97dcb796c1501dbf190339942542ce042702cdf8bf924e7557cf7459155dbf2425f748fcc7f
  • SSDEEP 49152:DnsHyjtk2MYC5GDXEgJL2No7eFBVtoSYRectq8pggJAC/al:Dnsmtk2asESLtqFDtMRPx8C2
  • TLSH
    T1C2B5F132B6D18437D1731A3C9D5BA3A5983ABE511E38354F7BF82E4C5F3A28129252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryxredpersistenceprivilege_escalationadwareransomwarespyware

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2