Extracted

• • Target
    2026-08-09_360e7c04e44a1be918cd728044820598_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_redline-stealer_rhadamanthys_stop
  • Size 12.6MB
  • SHA256 2b7d5fb88214d3a1baee153c80200204541794b7c0996a8ec8e15b027262e5a9
  • MD5 360e7c04e44a1be918cd728044820598
  • SHA1 71e91384a9007edb8189629a017c02d0ef4b6c80
  • SHA512 540732fb5432a7511daa89e7746dac5fc41197a210af0e22e55741561b060203bc69ede1ebde4db2c2f2c55b8e9bcf5073d36866ca0add09c775266b93f33ec7
  • SSDEEP 196608:CLJDb5pRlb+U0hUXWqaIQWJNey3UtUzIRUYJvJrCcf1l9OZqtSZ0FkD2peSnGL:CF5F+LUmbSexYIp3Cyl4Z4fkKpwL
  • TLSH
    T1C7D63323F2D18537D132193CCC67A2B594297E51AE38364B7BF93E9D6F3928128152E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordiscoveryxredpersistencephishingprivilege_escalationspywarestealermacro

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Drops file in Drivers directory

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2