xred | ab82ee6429195252c58e5ecccc0192d0bf06792d667f56e64c75e8ef9a4056db

General

Target
2026-07-19_bdd5ef9c324c832eceaed309acc6703b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.9MB
Sample260720-a1my3acy8t
SHA256 ab82ee6429195252c58e5ecccc0192d0bf06792d667f56e64c75e8ef9a4056db
MD5 bdd5ef9c324c832eceaed309acc6703b
SHA1 2386385759f7abf6a6e812f1d7a0d87ac7b3154d
SHA512 64c1c2127d05ee928d6556ddbf172db8cf111883757c819d7ecbda81cde77543c8125dd43dae1f99c8b9a49f4cf9f2ef1e421e31a7da41a66efc9d66d2774dd2
SSDEEP 49152:6nsHyjtk2MYC5GDRwaCgQeID75q5TJmTSNNxkWA:6nsmtk2aYCgQeq
TLSH
T127956B23B2A1843ED1B246348C6F9E60856ABD731E39514BB7E0FE1C2EF45817923B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-07-19_bdd5ef9c324c832eceaed309acc6703b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 1.9MB
- SHA256 ab82ee6429195252c58e5ecccc0192d0bf06792d667f56e64c75e8ef9a4056db
- MD5 bdd5ef9c324c832eceaed309acc6703b
- SHA1 2386385759f7abf6a6e812f1d7a0d87ac7b3154d
- SHA512 64c1c2127d05ee928d6556ddbf172db8cf111883757c819d7ecbda81cde77543c8125dd43dae1f99c8b9a49f4cf9f2ef1e421e31a7da41a66efc9d66d2774dd2
- SSDEEP 49152:6nsHyjtk2MYC5GDRwaCgQeID75q5TJmTSNNxkWA:6nsmtk2aYCgQeq
- TLSH
  T127956B23B2A1843ED1B246348C6F9E60856ABD731E39514BB7E0FE1C2EF45817923B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution xred persistence
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Detects executables containing possible sandbox analysis VM usernames
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2