🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XRed


Vendor detections: 19


Intelligence 19 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6
SHA3-384 hash: 329b089b6cda6a855178e04a32a3e6528504aed1bf45bff15b89844739a4db849df45dbe347f4e6b3c24b5b31f9b1865
SHA1 hash: 6fe767347543cf94386c17d98306ffd2798b2438
MD5 hash: 19f88273e1076a090e4ec439c2ee560c
humanhash: louisiana-seventeen-ohio-colorado
File name:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6.exe
Download: download sample
Signature XRed
Create hunting rule
File size:4'404'736 bytes
First seen:2026-09-08 02:08:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 332f7ce65ead0adfb3d35147033aabe9 (103 x XRed, 18 x SnakeKeylogger, 11 x DarkComet)
ssdeep 98304:jnsmtk2aaAD1e6OE6wDSUIEgzD/NrS27fgAf1HKcU/Y/:7LhADzOEpSUhglu27oAf5t
TLSH T118161222B2D18437D1322A3C9C6BA3A5583EBE513D38764E7BE91D4C8F396423D652D3
TrID 91.2% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
3.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
1.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b6f09e1761e633b2 (1 x XRed)
Reporter Tuxxin
Tags:exe whack.sh xred

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSO XRed
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e7016202-a403-444c-beae-b0356dbd4a81/
Malware family:
sogou
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-08 02:16:34 UTC
Tags:
auto-reg xred backdoor qihoo360 adware sogou upx delphi dyndns arch-doc
Link:
https://app.any.run/tasks/a02867d1-6d1a-4a76-b7cc-9c8fd771d36f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84461/
Detection(s):
MiscreantPunch.EvilMacro.PVDISABLE.170819.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.D1s1g-1
Create hunting rule

PUA.Win.Packer.D1s1g-2
Create hunting rule

PUA.Win.Packer.D1s1g-5
Create hunting rule

SecuriteInfo.com.Other.Malware-gen.4213.13336.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.HanciInterruptMyDayHandler.20210721.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PKILLDropboxMacroDirectDownload.20220331.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PolicyKillOnlyHappyWhenItRains.20210704.UNOFFICIAL
Create hunting rule

Win.Malware.Agen-8002901-0
Create hunting rule

Win.Malware.Delf-6899401-0
Create hunting rule

Win.Malware.Vindor-10034624-0
Create hunting rule

Win.Malware.Vindor-10034625-0
Create hunting rule

Win.Trojan.Emotet-9850453-0
Create hunting rule

Win.Trojan.Generic-9936029-0
Create hunting rule

Xls.Dropper.Agent-7382066-0
Create hunting rule

YARA.RUSSIANPANDA_Mal_Xred_Backdoor.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac76b3362124a8529d107d6
Tags:
dropper delphi virus smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Moving a recently created file
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Modifying an executable file
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Forced system process termination
DNS request
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Sending a UDP request
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Moving a file to the %AppData% subdirectory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Infecting executable files
Verdict:
Malicious
Labled as:
Comet.A
Link:
https://www.hybrid-analysis.com/sample/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6
Verdict:
Malicious
File Type:
exe x32
First seen:
2020-05-19T04:05:00Z UTC
Last seen:
2026-09-09T18:29:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6/results?tab=lookup
Malware family:
XRed
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1008ed9e-4d8a-43e0-b6b8-7bc05fedf03e
Result
Threat name:
XRed
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1969685
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to infect the boot sector
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Suricata IDS alerts for network traffic
Uses dynamic DNS services
Yara detected XRed
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1969685 Sample: bIqMsTN1w0.exe Startdate: 08/09/2026 Architecture: WINDOWS Score: 100 61 freedns.afraid.org 2->61 63 speed.netmon.360safe.com 2->63 65 39 other IPs or domains 2->65 91 Suricata IDS alerts for network traffic 2->91 93 Found malware configuration 2->93 95 Antivirus detection for URL or domain 2->95 99 10 other signatures 2->99 9 bIqMsTN1w0.exe 1 6 2->9         started        12 EXCEL.EXE 179 53 2->12         started        15 Synaptics.exe 2->15         started        signatures3 97 Uses dynamic DNS services 61->97 process4 dnsIp5 53 C:\Users\user\...\._cache_bIqMsTN1w0.exe, PE32 9->53 dropped 55 C:\ProgramData\Synaptics\Synaptics.exe, PE32 9->55 dropped 57 C:\ProgramData\Synaptics\RCX5ECE.tmp, PE32 9->57 dropped 59 C:\...\Synaptics.exe:Zone.Identifier, ASCII 9->59 dropped 17 ._cache_bIqMsTN1w0.exe 7 9->17         started        21 Synaptics.exe 47 9->21         started        79 150.171.109.118 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 12->79 file6 process7 dnsIp8 41 C:\Users\user\AppData\Local\Temp\...\sg.tmp, PE32 17->41 dropped 81 Antivirus detection for dropped file 17->81 83 Multi AV Scanner detection for dropped file 17->83 85 Contains functionalty to change the wallpaper 17->85 89 4 other signatures 17->89 24 sg.tmp 42 17->24         started        27 360SpeedTest.exe 17->27         started        31 cmd.exe 1 17->31         started        67 freedns.afraid.org 67.220.81.150, 80 OBJX-objxnetLLCUS United States 21->67 69 drive.usercontent.google.com 142.251.34.129, 443, 49710, 49711 GOOGLE-GoogleLLCUS Mexico 21->69 71 docs.google.com 192.178.50.46, 443, 49706, 49707 GOOGLE-GoogleLLCUS United States 21->71 43 C:\Users\user\Documents\DUUDTUBZFW\~$cache1, PE32 21->43 dropped 87 Drops PE files to the document folder of the user 21->87 33 WerFault.exe 21->33         started        35 WerFault.exe 21->35         started        file9 signatures10 process11 dnsIp12 45 C:\Users\user\AppData\Local\...\urlproc.dll, PE32 24->45 dropped 47 C:\Users\user\AppData\Local\...47etSpeed.dll, PE32 24->47 dropped 49 C:\Users\user\AppData\...\360SpeedTest.exe, PE32 24->49 dropped 51 13 other malicious files 24->51 dropped 37 conhost.exe 24->37         started        73 104.192.108.150, 49733, 80 QIHOOBeijingQihuTechnologyCompanyLimitedCN United States 27->73 75 104.192.108.17, 49739, 49742, 49747 QIHOOBeijingQihuTechnologyCompanyLimitedCN United States 27->75 77 25 other IPs or domains 27->77 101 Contains functionality to infect the boot sector 27->101 103 Contains functionality to compare user and computer (likely to detect sandboxes) 27->103 39 conhost.exe 31->39         started        file13 signatures14 process15
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6
Verdict:
Malware
YARA:
5 match(es)
Tags:
ADODB.Stream Blacklist VBA COM Behavior Trace DeObfuscated Executable Obfuscated PDB Path PE (Portable Executable) PE File Layout scripting.filesystemobject SFX 7z SOS: 0.38 T1027 T1059.005 T1112 VBScript Win 32 Exe WinHttp.WinHttpRequest.5 WinHttp.WinHttpRequest.5.1 WScript.Shell x86
Link:
https://app.malva.re/file/19f88273e1076a090e4ec439c2ee560c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6/
Threat name:
Win32.Worm.AutoRun
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 23:44:50 UTC
File Type:
PE (Exe)
Extracted files:
81
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72esyscvtfc6pzyhux7nkmsk2xbfrdpaszivfqhm3c3onmd6k3la._file
Verdict:
malicious
Label(s):
XRedBackdoor
Create hunting rule
Link:
https://reports.threatray.com/fdde63e5-59a9-4c91-807a-bcbd1f7b63db
Result
Malware family:
xred
Create hunting rule
Score:
  10/10
Tags:
family:xred backdoor bootkit discovery execution macro persistence upx
Link:
https://tria.ge/reports/260908-ck5v2szend/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Drops file in System32 directory
UPX packed file
Adds Run key to start application
Writes to the Master Boot Record (MBR)
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Suspicious Office macro
Family: Xred
Malware Config
C2 Extraction:
xred.mooo.com
Unpacked files
SH256 hash:
fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6
MD5 hash:
19f88273e1076a090e4ec439c2ee560c
SHA1 hash:
6fe767347543cf94386c17d98306ffd2798b2438
Detections:
triage_xred_backdoor
Create hunting rule
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
692b9c38b6ea50527c39be1104a63cd1ac214b6d33aa164567318ad0befc4e1c
MD5 hash:
d1a3952a48fbcef2549644c25530fa8e
SHA1 hash:
03165ddccaa8b66ca4ff9b4b052d8dd11137750c
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
1c08739667dce46a756b0c2243de5d0131f232a6d7bc8f55fcab19dd04f3d1d5
MD5 hash:
4180f2dfd5bf3be2663c58ab55b0f81f
SHA1 hash:
183d4fdffcd103fa0e9d957c0652eaf59b586ff8
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
f25aa880ac8a26a7cfb5bfda692aee286a6a5d79a8405c5f074538a44ed94ce0
MD5 hash:
2008205fcdaff9d2c1850630407d0661
SHA1 hash:
286d157c5173dcc30fa9445c32655d97e3038724
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
7d3ed444c6166070039565e0fca267bff6dcaf30a1e366ec47264bf4a5a31353
MD5 hash:
8e695f25ce06ed9fcc8f0a3ac72a1232
SHA1 hash:
29ff8df8da1b2af427fdf1a7ffd8bda95da7d6f1
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
fe84fa4a64575b4c39d0d9fae850a15084d53476b17d9b8c9c1ee2a89167ae97
MD5 hash:
650afd37938d0dc161d6df9231238b3c
SHA1 hash:
8433e4923dedda61e339b9477277be4fde849376
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
e230e011b1f4008b6e06cf524baf7b6f6823e0a84ec02d56291692a8b40b8c36
MD5 hash:
0488648482b2df2b697a638814ab4bcc
SHA1 hash:
8e7a171be203fe6998ffccd88135685848c49eb8
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
18263c885baeba4690322752a6eb9559b2930921fb9fb20a224575d5de8cade5
MD5 hash:
6d9379cdedaa0d3702194e11acf411d6
SHA1 hash:
c5f1e9d7c91fb24e58796bee0d40bbb7823f9aed
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
8eb912be090199d51320547b2f8dc51778d4dec7e71b7a376e6a955a756f0f68
MD5 hash:
ed781e9841319645e5a5381c7398e77d
SHA1 hash:
d05645f1b3d6a2cb7e752172f02e1ab331464c93
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
cb69497b07c2dc452c1d6d35b22f297759cec5b610834a2b918b566fc5f17539
MD5 hash:
0d78ccbc5cf0697e95977678c372dde9
SHA1 hash:
fe0b6948549f17cd497ec74e37a69e281253525f
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
f0a46f95fc46cf6b26bcb2f988bd60dae780abb53f40bf8740003188718a271f
MD5 hash:
585171f6be6b28388af1f0bebf75cb9f
SHA1 hash:
f3818bf8e40545f83011c68bdd2a86b5efe8593e
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade
MD5 hash:
01c3370a28ca91a9cdf817ea75a193f4
SHA1 hash:
30311d34f7716c361c4355b2cead17fc5d68bf82
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c
MD5 hash:
1e801ff172ce300810f126ff998ef84d
SHA1 hash:
3d7a5a8f3c8feb167079744480c59b061ca100a8
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
5afc97ab14334f95ab2363cf71514605939ac0ef156c380bd72b59eb7354c79f
MD5 hash:
b4ff085d99f7f83e2d0cb2c47d147a42
SHA1 hash:
1d35c14e1f901ad5ede096638faa577326f40f74
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
9c822acb00e540b11a57b298a5baefe0703001e109017be55d0417cac631c171
MD5 hash:
ef3cdf3dd59ffb7b7d86de0f3cf90b11
SHA1 hash:
1d37192e5fc19917d315b15dd8affbe4fc8db1f9
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
408e00c3f6796c67e5e47d043b3ef0c7cd369c291dd9efdd33c50669c0cfceee
MD5 hash:
0fca0240fc1152cbd303eb3fb03dc9c4
SHA1 hash:
32c7ba55905eb08ca3aef9a8b61c56b9aa0ad114
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
1e65653af66afa0a5c5ddbc8c2a42d037f27265d1a742d1b4924e2c4ba1e66ec
MD5 hash:
44322339085c4071274c6adea4e22b69
SHA1 hash:
3557d5762ff004c963e679ec679bdb3da8f5ea64
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
a6d351650757b9c7710f6f71ecd641fb53488cc64cdcbeeb7a4d49f280ac2441
MD5 hash:
e2b33542babcbca579bea9bc7a249228
SHA1 hash:
521daf593c47ae57bac619c761c074cf0986f47c
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
9c807e5dfda4389f6ca7c7b47a0be7c2b742ad51400829000feed0a7efd23c2b
MD5 hash:
cd4a701e10f53f1f9c1a1d4338d72fe8
SHA1 hash:
694aaffbe0a509185531cd8a00fbfaa1a8b43f91
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
952c346cc14d5e4ab61a77160ec7b4730ebaaa2075e80926f43d0e081e685355
MD5 hash:
b2f227893d73030245323e577421a973
SHA1 hash:
75d0931adf908712918ec45e3348064a8060aa9a
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
f27e436ef72e609982e61b69234eb43266d745429eba649e29fc0c6912172efb
MD5 hash:
ad9c41a63a023ff39a09ab39387c46a3
SHA1 hash:
8df3ab02dc48c763acbc81fd37b8143d492ed364
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
d44e6d754e988bd8c84ba32bdb1cb672708d1b95ccef9d848dae62f7699a2fde
MD5 hash:
4ef3f8917daaf99626692d688d717fec
SHA1 hash:
a5791321e3059fb3a07bb1a35049912c7a3c1527
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
a7a9c2c2701c16b0158fcb3e3c749721d8bc24af6a42fbe30eb6e3d8b85e8f90
MD5 hash:
35cb2416da9d50f0c7039effbd714438
SHA1 hash:
b54c9f29d1f573619010662721de9cce99a71eab
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
d6eff4182b1cc0b5adc62083857ea760486a06999da2a6cf14be54512a272379
MD5 hash:
d49939fcd5a8e39c0f66d359220f6533
SHA1 hash:
f4d8009e86fe4f4f4f427b12fecdcb4b21cf81ef
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
7feca2b22b4a82a65c648672e6be9596d32e0d6503cd08fc52e13f4026de623a
MD5 hash:
5e480fd1c0129d2b69d6e2c042edd8d4
SHA1 hash:
dc110a1189d0abca6295cbd77d0d336219fd8ebf
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
SH256 hash:
24f5db70d3760beca575db80d30e71685de3615aa2723ec015cac1c8feca8482
MD5 hash:
53d57a7fc0b2d5fdbdfc502be34f59e7
SHA1 hash:
442de086b77dec02f891c4e1c934ae02606db4b2
Link:
https://www.unpac.me/results/46e975d0-6551-428f-bbd8-9b9556624afb/
Malware family:
XRed
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fe892c485599/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:D1S1Gv11betaD1N
Create hunting rule
Author:malware-lu
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XRed

Executable exe fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/84461/

Comments