exorcist | b1bcc54ef15f91d9291357eca02862174bd6158e95813eff1ab0c16ba48ff10e | Triage

Sharing

General

Target

5a63e7d371dd69c5625f5b48da426c14.exe
Size

43KB
Sample

200724-gmz55kbvr2
MD5

5a63e7d371dd69c5625f5b48da426c14
SHA1

63a5bd8b7ed922ad5fe498d2a15a57d1d552055a
SHA256

b1bcc54ef15f91d9291357eca02862174bd6158e95813eff1ab0c16ba48ff10e
SHA512

a228061433052e64965ee9cdd678bbe2fa18c88b214642176437504b107c97f68912b1760f15b1e56a7bc9d5ac14ddd1bb2dcfdf27958e88e1a5f0db6cfbc767

Score

10^/10

exorcist persistence ransomware

Malware Config

Targets

- Target
  
  5a63e7d371dd69c5625f5b48da426c14.exe
- Size
  
  43KB
- MD5
  
  5a63e7d371dd69c5625f5b48da426c14
- SHA1
  
  63a5bd8b7ed922ad5fe498d2a15a57d1d552055a
- SHA256
  
  b1bcc54ef15f91d9291357eca02862174bd6158e95813eff1ab0c16ba48ff10e
- SHA512
  
  a228061433052e64965ee9cdd678bbe2fa18c88b214642176437504b107c97f68912b1760f15b1e56a7bc9d5ac14ddd1bb2dcfdf27958e88e1a5f0db6cfbc767
Score

10^/10

ransomware persistence exorcist
- Exorcist
  Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
  ransomware exorcist
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Enumerates connected drives
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarepersistence

behavioral2

ransomwarepersistence