xred | 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e

General

Target
2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop
Size 12.5MB
Sample260720-qbppcsds8x
SHA256 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e
MD5 792f2e49b9763fc40d089f35d82f087f
SHA1 387e2929c8f096770843dd4f5a8477b9af45494b
SHA512 5018923d38e7edbe54933fa36b9280bb89c7ae6a3943ae93531a213c6474bb2644cfc6a4efa541032c0c517dfd4907d545c5c58ecca5287b0be478a377b4e66a
SSDEEP 196608:fLcv5pBOOXT3N1kMvI+BtcI1W7NncfxJUCUa/msZrGWfGbMZz3JqRkD2pebltfkk:fWqOX5+Mx5wnat/mcG1IZkkKpsLfkqJ
TLSH
T1EDD63323F1D2853BD1725A3CDC6792B5442ABE41AE28364F7BF93D9D6E3D2812C141A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop
- Size 12.5MB
- SHA256 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e
- MD5 792f2e49b9763fc40d089f35d82f087f
- SHA1 387e2929c8f096770843dd4f5a8477b9af45494b
- SHA512 5018923d38e7edbe54933fa36b9280bb89c7ae6a3943ae93531a213c6474bb2644cfc6a4efa541032c0c517dfd4907d545c5c58ecca5287b0be478a377b4e66a
- SSDEEP 196608:fLcv5pBOOXT3N1kMvI+BtcI1W7NncfxJUCUa/msZrGWfGbMZz3JqRkD2pebltfkk:fWqOX5+Mx5wnat/mcG1IZkkKpsLfkqJ
- TLSH
  T1EDD63323F1D2853BD1725A3CDC6792B5442ABE41AE28364F7BF93D9D6E3D2812C141A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery xred persistence phishing privilege_escalation spyware stealer
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2