Extracted

• • Target
    2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 1.9MB
  • SHA256 f95958166440716b85faab2cedcabe6d0875b5acd5ddefedacb896f5525d913e
  • MD5 3e62a69c6d68efdbe257304f1c8cb96b
  • SHA1 1133ad7ec0d032027a595ad58465f1d724b93d93
  • SHA512 cfeee4f87f32a7a690bc77f3e5be5d9690fc4193039fb53c50f6fa0722c31dad2b7c3547bbd700f7653be39e28bae98168dffa9a5592f3d7b6f79e193715b073
  • SSDEEP 24576:6nsJ39LyjbJkQFMhmC+6GD9E4CxsVMdvaPg6cCkqNcf02iyi6/tzhIbsmBGT2hG+:6nsHyjtk2MYC5GDzCcMdxUsZT2za
  • TLSH
    T1AC956C27E65390BAC45332374A8BD1DB2524BB1488217E9F6FEC1C5CFB3975078292A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionxredpersistenceadwarespyware

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Custom signature

    Detects executables containing possible sandbox analysis VM usernames

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2