Extracted

• • Target
    2026-10-10_bb533860c34865ec6e5988f881714c8b_coinminer_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader
  • Size 979KB
  • SHA256 9960c0e908ffe4e0773a1db4404388e6d4e0fdd860f6056b1fd25722d9d47ad5
  • MD5 bb533860c34865ec6e5988f881714c8b
  • SHA1 031ad226336f3338ff3eab29abce03cc87cb25ae
  • SHA512 5c0ddd7a386e5cdd2e59b43e14531f10265964095fb7b8140a369ab7dc1fd2094702726b02c63b4a9b0d59db3dcbd9d500eb207c20657e67286574b0015d9b77
  • SSDEEP 12288:nMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9iODxCq5x+bMNlA3ssP:nnsJ39LyjbJkQFMhmC+6GD9k4nA/
  • TLSH
    T1C0256D22B6D1C433D1721A38CCABD2F55839BE512E34694F37E43E4E7F3A6812925693
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryxredpersistencespywarestealertrojan

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2