Extracted

Extracted

• • Target

    ohtie89k.exe

  • Size

    148KB

  • MD5

    ba57c75d6c4e2936f6cad4a1ba4c29d1

  • SHA1

    8299498803759fbb63a323b0ad64694d72d0c352

  • SHA256

    c54714fec4a8cab57d0f0304210fc2f4f50f6fbcee80fc2d3db9cf30a31853d2

  • SHA512

    3dcf87f4242b0c71c35c28f9f68e9994df8ce0888119ace1d4433303d22d856e45bf47dd88d7c4c5b32c2806f60187470f1548296bbfd7d27f87bb6526f7a10b

  • SSDEEP

    3072:sFZbBnzDocMDOhTxVpK4x3ZlhNxB2S+T0Wu4wvAaqifHulgOw:SBnrMDuR95HjxBT+T0zk4Yh

  Score

  10^/10

  redlinesectopratxwormnewestdiscoveryinfostealerpersistencerattrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2