Extracted

• • Target
    FireFox.exe
  • Size 1.0MB
  • SHA256 6c327feb4648ef12a50256eafc51f2272ac69a7052be96703d845d38b95c9900
  • MD5 31b3922c04e6e1cce061fc071be38b4b
  • SHA1 e52d4835a4de8210dee50b9f76b4d3779ec07187
  • SHA512 faa5dd6155275b1df89da927f4ddcb860619ce10bd82c4e53ec8782e7b672125566f2549e8dd9836492a342ea0897a2933099f08c5c1fdd1009a11137d93631a
  • SSDEEP 12288:eMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V99SS4Jj:ensJ39LyjbJkQFMhmC+6GD9a
  • TLSH
    T12D359E36F6D18437C1361A3CCC5BA3B4592ABE512D35B94B3BE43E4DAE3A6812C152D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryxredpersistenceexecutionprivilege_escalation

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2