Extracted

• • Target
    2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat_remcos_swisyn
  • Size 2.1MB
  • SHA256 d66706774b42094814148e82ca9d2aae4f289acefb7ef8a48fc20a06c1bf15ce
  • MD5 e8f2514893193d832bf5a02f5a204307
  • SHA1 eaa70c46ef2be66d5f015e397123288caf543ab1
  • SHA512 cbc85459c92318efbbb403dfa90c407b5be7070dea7aeddf3955049f3d2273eeb1b3aaa0b770e7c2774115f2025070ce68012f72375f080f2048a403b5b82eec
  • SSDEEP 49152:tSnsHyjtk2MYC5GDTM9QPdxwfE7WlFwKAfzuTiDFUFk5:Mnsmtk2a01PdVQFwKZCFge
  • TLSH
    T17FA5E123B6D18437D1730A385CAA93A56836BE612E34BD4F37E42E4C5F396827835397
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryxredpersistenceprivilege_escalationspywarestealertrojanmacro

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2