Xred

The XRed backdoor also possesses worm-like USB propagation capabilities. It verifies the presence of an “autorun.inf” file on any inserted drive; if absent, it generates the file

This article highlights the identification of the XRed backdoor, its delivery using trojanized software... The trojanized version of Windows InstantView.exe drops Synaptics.exe payload

The attack begins when a victim receives a phishing email or visits a spoofed website carrying official government branding, complete with fabricated reference numbers, compliance deadlines, and official-sounding language designed to create urgency.

The attack begins when a victim receives a phishing email or visits a spoofed website carrying official government branding... The victim is then directed to click a download button, which immediately fetches a malicious ZIP archive onto their device.

The following remote commands can be executed from attacker’s server: GetCMDAccess – obtaining command prompt access.

The malicious VBA script disables security warnings for VBA macros via the registry

The backdoor has an embedded password-protected VBA script. The script creates a copy of already existing XLSM files on the disk and injects the malicious VBA code into them.

The persistence is achieved via the Registry Run Key (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) with the value name “Synaptics Pointing Device Driver”

The persistence is achieved via the Registry Run Key (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) with the value name “Synaptics Pointing Device Driver”

The trojanized “Windows InstantView.exe” is not signed and has “Synaptics Pointing Device Driver” for Product and Description names.

The trojanized version of Windows InstantView.exe drops Synaptics.exe payload under C:\ProgramData\Synaptics\... The folder was hidden to ensure stealthiness.

The malicious VBA script disables security warnings for VBA macros via the registry

Additionally, the backdoor features keylogging functionality through keyboard hooking

XRed collects system information, including the MAC address, username, and computer name

The following remote commands can be executed from attacker’s server: ListDisk – list existing disks. ListDir – list directories.

The XRed backdoor also possesses worm-like USB propagation capabilities. It verifies the presence of an “autorun.inf” file on any inserted drive; if absent, it generates the file

Additionally, the backdoor features keylogging functionality through keyboard hooking

The following remote commands can be executed from attacker’s server: GetScreenImage – capture screenshot.

Upon executing the trojanized binary, it downloads the legitimate copy of InstantView.exe from siliconmotion[.]com and launches it as a decoy... The payload contains the functionality to retrieve additional payload from the URLs that can be hardcoded in the binary.

XRed collects system information... and transmits this data to the attacker using SMTP to email addresses shown in Figure 12.