Extracted

• • Target
    0cc4dbb88324be4b0bdd063830efeee9625d01304a52a8daad339f681c978e1b
  • Size 4.4MB
  • SHA256 0cc4dbb88324be4b0bdd063830efeee9625d01304a52a8daad339f681c978e1b
  • MD5 82f7a41154cc84bb68113208c7aaec7e
  • SHA1 7cd8184e7324f80cc20837be39ba65a3592762fd
  • SHA512 f1656fddde516a83fd933111e4d0cb01819d8364d8f161e7071e98346dfad866be686ba1498bef10b664abbf046a29f6d5e62300371e507304ea7029ee0dd149
  • SSDEEP 98304:8nsmtk2aqxQd8L1KDxq3UPWOGwC9A9bxdV1QedxZccn4jsbPhJuybBSWWmO1kIGR:SLUtG69xZb4gLnbBSWWn1EoGvP
  • TLSH
    T167261223B2D14576D1335A3E9C5BA3A49829BE512E34A90F3BF52D5C8F3D2823D252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryxredmacropersistencespywarestealertrojanupx

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Downloads MZ/PE file

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1