xred | b3ba9cd92f835e235c7129c24ff37aadc334e54dcf32209d35c27cd1fe465fde

General

Target
2026-07-19_0d658ae4c646d2bc4df625e422c4adfc_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop
Size 6.5MB
Sample260719-3nar7agv3r
SHA256 b3ba9cd92f835e235c7129c24ff37aadc334e54dcf32209d35c27cd1fe465fde
MD5 0d658ae4c646d2bc4df625e422c4adfc
SHA1 80588eb56763496221a32fb9dfae374e63ba0995
SHA512 dbbd09c4867a66e10be8d845de59c8439ec5b3b24f82559cee838730b7717f69804217bb1c2b3bb4aa422911ff08b7ed6eea301d452cc88f6e63347857b9abe4
SSDEEP 98304:Onsmtk2auq3mXe/hpCrHQzP4vVR8qLf3gbz2FSmaI7dlJMGu:QLJe/hpawiQbz2FSmaI7dl2F
TLSH
T1E8669E52BF8C817AC55A1531472DAF6A402ABD943B3465C3B2B43E7DDC363C26C3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-07-19_0d658ae4c646d2bc4df625e422c4adfc_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop
- Size 6.5MB
- SHA256 b3ba9cd92f835e235c7129c24ff37aadc334e54dcf32209d35c27cd1fe465fde
- MD5 0d658ae4c646d2bc4df625e422c4adfc
- SHA1 80588eb56763496221a32fb9dfae374e63ba0995
- SHA512 dbbd09c4867a66e10be8d845de59c8439ec5b3b24f82559cee838730b7717f69804217bb1c2b3bb4aa422911ff08b7ed6eea301d452cc88f6e63347857b9abe4
- SSDEEP 98304:Onsmtk2auq3mXe/hpCrHQzP4vVR8qLf3gbz2FSmaI7dlJMGu:QLJe/hpawiQbz2FSmaI7dl2F
- TLSH
  T1E8669E52BF8C817AC55A1531472DAF6A402ABD943B3465C3B2B43E7DDC363C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor google defense_evasion discovery xred persistence phishing spyware stealer trojan
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Drops file in System32 directory
behavioral1 behavioral2