Extracted

• • Target
    2026-10-17_c6d138e618adaf5922e89bf070b3bae8_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_luca-stealer_njrat
  • Size 2.0MB
  • SHA256 3ab7f67a6b2d6c7653e5bc5decd752d7e7c982af65f92d1ea26f0e2907ac57b9
  • MD5 c6d138e618adaf5922e89bf070b3bae8
  • SHA1 55b7bb412cdf83de4071d0e0bd7c675c2dbe8005
  • SHA512 c4ad817eea413923d6d21b6f42d21ac7f98e67651aae7c6ab04b01c32e454a394b21dface0576fa94c7634a6e96eba0e1e63bd4c4b7c51f1302957ebf2e9538a
  • SSDEEP 49152:3nsHyjtk2MYC5GDUr/50iIDBUqJ5Idarvkdu2KIJ7nWcWMwvSnpMYR:3nsmtk2azrhZIDDvkduNIVnWuTnms
  • TLSH
    T18995E032B2D18437D1731A3C9CABA3A5483EBE612E34794F37E41E4C5F3968169252E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryxredpersistenceprivilege_escalationspywarestealertrojan

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2