MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 627758d18d773a74dd10d6066d68e72c1db2ba5fa81f5535b6b00c4e9b01927b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
XRed
Vendor detections: 12
| SHA256 hash: | 627758d18d773a74dd10d6066d68e72c1db2ba5fa81f5535b6b00c4e9b01927b |
|---|---|
| SHA3-384 hash: | 12625bbe5d46c6a198f2e998c636cbfb8f66136937aca4825195a118a459674df906d0a2c6c252638599e97f3d6ce894 |
| SHA1 hash: | a4b664d5e7486ef428ef5f3310c497965d6afcfd |
| MD5 hash: | 623ae65c1482740a826e1313e8c781db |
| humanhash: | cola-stairway-nitrogen-earth |
| File name: | IObitUnlocker.exe |
| Download: | download sample |
| Signature | XRed |
| File size: | 3'193'344 bytes |
| First seen: | 2025-06-03 20:29:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 332f7ce65ead0adfb3d35147033aabe9 (81 x XRed, 18 x SnakeKeylogger, 7 x DarkComet) |
| ssdeep | 49152:NnsHyjtk2MYC5GDqTT/eC2wpBBseA/FsZDW8nTeCPGXOyv:Nnsmtk2az//eC7BBdA/cFPMOyv |
| Threatray | 425 similar samples on MalwareBazaar |
| TLSH | T1EEE56E21B2D28637D4731E799C3B97A8A8397E211E24584B3EF57F4C1F397816C29293 |
| TrID | 83.4% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58) 5.4% (.EXE) InstallShield setup (43053/19/16) 5.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 1.7% (.EXE) Win32 Executable Delphi generic (14182/79/4) 1.3% (.EXE) Win64 Executable (generic) (10522/11/4) |
| Magika | pebin |
| dhash icon | c4b0b074666a6674 (1 x XRed) |
| Reporter |  aachum |
| Tags: | exe xred |
iamaachum
https://github.com/RanjitGandhi2/fff/raw/refs/heads/main/IObitUnlocker.zipXRed C2: xred.mooo.com
Intelligence
File Origin
# of uploads :
1
# of downloads :
469
Origin country :
ESVendor Threat Intelligence
Detection:
n/a
Verdict:
Malicious
Score:
99.9%
Tags:
dropper delphi virus smtp
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Moving a recently created file
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Modifying an executable file
DNS request
Connection attempt
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Infecting executable files
Verdict:
Malicious
Labled as:
Trojan.DarkKomet
Malware family:
XRed
Verdict:
Malicious
Result
Threat name:
XRed
Detection:
malicious
Classification:
troj.expl
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Yara detected XRed
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Worm.Zorex
Status:
Malicious
First seen:
2024-12-11 21:53:33 UTC
AV detection:
35 of 37 (94.59%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
xredbackdoor
Similar samples:
+ 415 additional samples on MalwareBazaar
Result
Malware family:
xred
Score:
10/10
Tags:
family:xred backdoor discovery persistence
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Xred
Xred family
Malware Config
C2 Extraction:
xred.mooo.com
Verdict:
Malicious
Tags:
backdoor xred_backdoor Win.Trojan.Emotet-9850453-0
YARA:
mal_xred_backdoor
Unpacked files
SH256 hash:
627758d18d773a74dd10d6066d68e72c1db2ba5fa81f5535b6b00c4e9b01927b
MD5 hash:
623ae65c1482740a826e1313e8c781db
SHA1 hash:
a4b664d5e7486ef428ef5f3310c497965d6afcfd
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
SH256 hash:
bfdafb4e27db3f229f3a56415374b19df08724a2c440fa32cd904c8125871d18
MD5 hash:
f3ec701d4e78045ca9d06903919ff990
SHA1 hash:
b750977a207380b1737569d3de5b246e26527e9f
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| Rule name: | BobSoftMiniDelphiBoBBobSoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| Rule name: | D1S1Gv11betaD1N |
|---|---|
| Author: | malware-lu |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | HUNTING_SUSP_TLS_SECTION |
|---|---|
| Author: | chaosphere |
| Description: | Detect PE files with .tls section that can be used for anti-debugging |
| Reference: | Practical Malware Analysis - Chapter 16 |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | vbaproject_bin |
|---|---|
| Author: | CD_R0M_ |
| Description: | {76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time |
| Rule name: | win_rat_generic |
|---|---|
| Author: | Reedus0 |
| Description: | Rule for detecting generic RAT malware |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| Rule name: | yara_template |
|---|
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.