🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XRed


Vendor detections: 19


Intelligence 19 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c
SHA3-384 hash: fa1bd37c9fdee30ba48793d277d08aaba2f8a8f29e30d0610c09eb59a0ff92db81529458ebc7a0bfc3874b1b7615edac
SHA1 hash: a8e2d79ce69eba035dc87ee8730c3d926bcf070a
MD5 hash: 94e791c4f0e69665c326c0ec634aa0b6
humanhash: white-sweet-burger-sad
File name:a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c.exe
Download: download sample
Signature XRed
Create hunting rule
File size:6'545'920 bytes
First seen:2026-10-04 03:39:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 332f7ce65ead0adfb3d35147033aabe9 (103 x XRed, 18 x SnakeKeylogger, 11 x DarkComet)
ssdeep 98304:Snsmtk2aYeD21u2seJKLcxndGaX6tJJQv2FKA75OpVclc02vDRZTEw:cLcD21u2segLoo3u0jc02vVZow
TLSH T12C6612337E55E03BD0221A3A9C9772D40A2BBE119D362C4A26E71E4F0B26DF7593D193
TrID 88.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
5.7% (.EXE) InstallShield setup (43053/19/16)
1.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.8% (.EXE) Win64 Executable (generic) (6522/11/2)
Magika pebin
dhash icon 70e49eb2ba9ef870 (1 x XRed)
Reporter whack_sh
Tags:exe xred

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSO XRed
Details
Link:
https://research.acce.ciphertechsolutions.com/results/10e8fc4a-168a-4ff8-a73f-da85d5ac1bb8/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-04 03:43:22 UTC
Tags:
xred backdoor auto-reg winring0x64-sys vuln-driver delphi dyndns
Link:
https://app.any.run/tasks/8c458931-c152-4e7e-b1e8-f1fb4f160fed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90554/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acf3bc06f551121ba14f891
Tags:
delphi rozena madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Moving a recently created file
Creating a file in the %temp% subdirectories
Searching for the window
Delayed reading of the file
Modifying an executable file
Deleting a recently created file
DNS request
Changing a file
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a service
Launching a service
Loading a system driver
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Enabling autorun for a service
Infecting executable files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 borland_delphi cmd downloader dropper emotet evasive fingerprint installer-heuristic keylogger lolbin overlay packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6ac1caaa2cb3c8aea87a16d7/reports/96ee6129-dfe2-4563-843f-63ae0f7685c1/overview
Verdict:
Malicious
Labled as:
Comet.A
Link:
https://www.hybrid-analysis.com/sample/a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-11-20T23:35:00Z UTC
Last seen:
2026-10-05T21:28:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c/results?tab=lookup
Malware family:
XRed
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d42f1d35-bb80-486b-a61e-9625bd1d85dd
Result
Threat name:
XRed
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1981846
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Yara detected XRed
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1981846 Sample: Xe1Tha2gdg.exe Startdate: 04/10/2026 Architecture: WINDOWS Score: 100 83 freedns.afraid.org 2->83 85 xred.mooo.com 2->85 87 7 other IPs or domains 2->87 95 Suricata IDS alerts for network traffic 2->95 97 Found malware configuration 2->97 99 Antivirus detection for URL or domain 2->99 103 10 other signatures 2->103 10 Xe1Tha2gdg.exe 1 6 2->10         started        13 svchost.exe 2->13         started        16 svchost.exe 1 1 2->16         started        19 9 other processes 2->19 signatures3 101 Uses dynamic DNS services 83->101 process4 dnsIp5 71 C:\Users\user\...\._cache_Xe1Tha2gdg.exe, PE32 10->71 dropped 73 C:\ProgramData\Synaptics\Synaptics.exe, PE32 10->73 dropped 75 C:\ProgramData\Synaptics\RCX897.tmp, PE32 10->75 dropped 77 C:\...\Synaptics.exe:Zone.Identifier, ASCII 10->77 dropped 21 ._cache_Xe1Tha2gdg.exe 19 10->21         started        25 Synaptics.exe 133 10->25         started        115 Changes security center settings (notifications, updates, antivirus, firewall) 13->115 28 MpCmdRun.exe 13->28         started        79 127.0.0.1 unknown unknown 16->79 30 WerFault.exe 19->30         started        file6 signatures7 process8 dnsIp9 57 C:\Users\user\AppData\...\vcruntime140.dll, PE32 21->57 dropped 59 C:\Users\user\AppData\...\nemu-downloader.exe, PE32 21->59 dropped 61 C:\Users\user\AppData\Local\...\msvcrt.dll, PE32 21->61 dropped 65 9 other malicious files 21->65 dropped 105 Sample is not signed and drops a device driver 21->105 32 nemu-downloader.exe 21->32         started        89 freedns.afraid.org 67.220.81.150, 49721, 80 OBJX-objxnetLLCUS United States 25->89 91 drive.usercontent.google.com 142.251.215.193, 443, 49718, 49719 GOOGLE-GoogleLLCUS United States 25->91 93 docs.google.com 142.251.45.14, 443, 49713, 49714 GOOGLE-GoogleLLCUS United States 25->93 63 C:\Users\user\Documents\~$cache1, PE32 25->63 dropped 107 Antivirus detection for dropped file 25->107 109 Multi AV Scanner detection for dropped file 25->109 111 Drops PE files to the document folder of the user 25->111 35 WerFault.exe 25->35         started        37 conhost.exe 28->37         started        file10 signatures11 process12 dnsIp13 81 mumu.nie.netease.com 42.186.25.77, 443, 49702, 49726 NETEASE-NETWORKNetEaseBuildingNo16KeYunRoadCN China 32->81 39 ColaBoxChecker.exe 32->39         started        43 HyperVChecker.exe 32->43         started        45 HyperVChecker.exe 32->45         started        47 HyperVChecker.exe 32->47         started        process14 file15 67 C:\Users\user\AppData\...\WinRing0x64.sys, PE32+ 39->67 dropped 69 C:\Users\user\AppData\Local\...\WinRing0.sys, PE32 39->69 dropped 113 Sample is not signed and drops a device driver 39->113 49 conhost.exe 39->49         started        51 conhost.exe 43->51         started        53 conhost.exe 45->53         started        55 conhost.exe 47->55         started        signatures16 process17
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c
Verdict:
Malware
YARA:
5 match(es)
Tags:
ADODB.Stream Archive 7z non extractible (chiffrée, corrompue ou vide) Blacklist VBA COM Behavior Trace DeObfuscated Executable Obfuscated PE (Portable Executable) PE File Layout scripting.filesystemobject SFX 7z SOS: 0.38 T1027 T1059.005 T1112 VBScript Win 32 Exe WinHttp.WinHttpRequest.5 WinHttp.WinHttpRequest.5.1 WScript.Shell x86
Link:
https://app.malva.re/file/94e791c4f0e69665c326c0ec634aa0b6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c/
Threat name:
Win32.Worm.Zorex
Create hunting rule
Status:
Malicious
First seen:
2025-07-16 19:58:18 UTC
File Type:
PE (Exe)
Extracted files:
615
AV detection:
35 of 38 (92.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=up6ncirhm42cydmjmk4ifd6kjzsueswxnqc74mkerblcsol2kioa._file
Verdict:
malicious
Label(s):
XRedBackdoor
Create hunting rule
Link:
https://reports.threatray.com/cdb6012a-64e3-4711-b9ae-a6322ad1f8c1
Result
Malware family:
xred
Create hunting rule
Score:
  10/10
Tags:
family:xred backdoor discovery persistence
Link:
https://tria.ge/reports/261004-d8c1lstw2j/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in System32 directory
Adds Run key to start application
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Family: Xred
Malware Config
C2 Extraction:
xred.mooo.com
Unpacked files
SH256 hash:
a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c
MD5 hash:
94e791c4f0e69665c326c0ec634aa0b6
SHA1 hash:
a8e2d79ce69eba035dc87ee8730c3d926bcf070a
Detections:
triage_xred_backdoor
Create hunting rule
mal_xred_backdoor
Create hunting rule
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
ec5ca66267d285460a38c221350b9d0d995a63616164ee50b8c3fa06423353d2
MD5 hash:
c94672d5e9f2e6bbb90c8d81187dcda5
SHA1 hash:
f8a67c64da6f2e25a98ac7ddb3d31a6612deabc7
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
2f980c56d81f42ba47dc871a04406976dc490ded522131ce9a2e35c40ca8616e
MD5 hash:
2f3d77b4f587f956e9987598b0a218eb
SHA1 hash:
c067432f3282438b367a10f6b0bc0466319e34e9
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
83f935454ae8e450b6f042509ecf28cceff95edb2495c63a782b9d45c2eaf1c0
MD5 hash:
ff877a5dffd764197250bd4ba28496b1
SHA1 hash:
187b8e183fc3331dd4ba139333886ad1fbf333a7
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
8598940e498271b542f2c04998626aa680f2172d0ff4f8dbd4ffec1a196540f9
MD5 hash:
1e6e97d60d411a2dee8964d3d05adb15
SHA1 hash:
0a2fe6ec6b6675c44998c282dbb1cd8787612faf
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
MD5 hash:
dbd84c6083e4badf4741d95ba3c9b5f8
SHA1 hash:
4a555adf8e0459bfd1145d9bd8d91b3fff94aad0
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
bf42783c293279c65b00e4f8b72be39e1cb0fcbe14d6679151b0d5e27fd8572d
MD5 hash:
97b382235264f18a53eff8e891997920
SHA1 hash:
cc0f3ad9411f54f70a2b1a1705e24048b06ea65c
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
f7ac4ceb149eae5184b957d90ebedd9bc916cd1ba3053548b637b4e32a7f8a07
MD5 hash:
f9e704b67eccd77a18965e9cfa128461
SHA1 hash:
45c0154c0128d356fa96f23689d945ce4122d975
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
1741bfab7c329ace0f94e78537770843796ea44b6488baf797d00d5d2502926c
MD5 hash:
318ee01a635bfbc639dba6f36387c4f2
SHA1 hash:
97c26f9523307bd9addda0e10894ebea1ddb32d7
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
f4144c72880239bceeed08261f3b0222ac00331635d8bcc2c1ce5188f3e6c3f9
MD5 hash:
323dd733ea8329b1f5bd0ea991028835
SHA1 hash:
3afbdd70e77834e3440f47e0f1dda230d4ec349a
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
1e733294caac4e1001d8c13f848db6debf36666992446344689d3bf53ed27db0
MD5 hash:
fa63a0e8118201c9cc3a3673acf96f00
SHA1 hash:
9735beb72e34335e4b423e8164d973594a36346d
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
94fc9d6d4e060f53fbe2ca63ca3bfe1f97be1842a9c90ae64d568835ab80278a
MD5 hash:
c7e37af3bc29d82c0fc6d02e587ae885
SHA1 hash:
164faf9a6975d54b4b80450849f438fd43c38157
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
SH256 hash:
7ab67fa2efc753bb57a65ff87a7089d7bbea1794847d006aba1d023e726610a6
MD5 hash:
a4ee9001360d1700e8ad5d217f0bc554
SHA1 hash:
eb143934306b9978279385bf2c8d0b5d32ac2db5
Link:
https://www.unpac.me/results/cef8fe99-a5e5-4594-9b93-b463e2a4c66e/
Malware family:
XRed
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a3fcd1222767/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:D1S1Gv11betaD1N
Create hunting rule
Author:malware-lu
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (archive, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_SliverFox_ForgeAuto_c1e18461
Create hunting rule
Author:Marjoriefort
Description:Detects SliverFox (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_99cdfd72_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_bd254b5c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XRed

Executable exe a3fcd1222767342c0d8962b8828fca4e65424ad76c05fe3144885629397a521c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/90554/

Comments