Extracted

• • Target
    2026-08-12_4071dfe54eb0c1ebdf115db8a77a391c_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat
  • Size 2.0MB
  • SHA256 606b7b9838c8cffff0bc5bd963b1c9c875c558cc0b701b068f6a2649130cbd01
  • MD5 4071dfe54eb0c1ebdf115db8a77a391c
  • SHA1 688f8edef971783a55a34e0660e62c4947682bca
  • SHA512 7d49764f772e5b69614334e8b101f158afa2e5679a8aedcf6379d7d74ef5c31279e394711a51825091ccec13ce01ef1c4c28c74e8717f6e661ac90e3ad0d7ba9
  • SSDEEP 49152:PnsHyjtk2MYC5GD3r/9XH10M9Z6IIyECTO1ziNWp:Pnsmtk2akrFH1VOyECTO1u6
  • TLSH
    T1D895E032F2D18437D1731A388CABA3A5583EBE612E34794E3BE51E4C5F3968179252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryxredpersistenceprivilege_escalationspywarestealertrojan

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2