Extracted

• • Target
    2026-07-31_35d52ddc25b59b68ca584f3bb6798089_amadey_coinminer_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_remcos_smoke-loader_stop
  • Size 12.4MB
  • SHA256 1e9c145844fd5db551ae00ca013f797b789ffe985c0973a14ae4e51fd2ca08b3
  • MD5 35d52ddc25b59b68ca584f3bb6798089
  • SHA1 11a5b9387d43ca22bba47cf6976b4fc1475c6e3c
  • SHA512 4ff4687e3bbff3fc13c203da40121b75fa9576fc5be9035429fdcc88e3e12eff68f7383476c6387ed491a7cd7da8c7e8836e90038d63484ef41f0ff23279c2a5
  • SSDEEP 196608:jLx8j790miokb/iLIkAIBJnh3cEh4y5qx9Z16cdmD6CHA9I4J2LLrkfddHeyy:jVHoIKRJ5czFxH4cUeI4JbdHeyy
  • TLSH
    T1BAD6BE32EA954076EDB302305DEDAF7551BBBA3D1A31845B22C46ECE1B789C0B726713
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionxredpersistencemacro

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects executables packed with VMProtect.

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2