exorcist | bf6e5f9d060ebc5bb70144ca6e795bfc249c6590ab9f45e258ec9b5f3d49eeb6 | Triage

Sharing

General

Target

fa4c4ac8b9c1b14951ae8add855f34e8.exe
Size

43KB
Sample

200724-kfjg2xf1b2
MD5

fa4c4ac8b9c1b14951ae8add855f34e8
SHA1

c5049dbdee3aaaf3a794edda02554789a25389bf
SHA256

bf6e5f9d060ebc5bb70144ca6e795bfc249c6590ab9f45e258ec9b5f3d49eeb6
SHA512

6d9d53cc430ea73684ec3c2e739d7dc01b7ce601a4a9073b77baf39d1f3e25ccc6d3f50a2e9b8bbaa275b8045cac370163d4e5a6a98aa736ca2c69b9820cee37

Score

10^/10

exorcist persistence ransomware

Malware Config

Targets

- Target
  
  fa4c4ac8b9c1b14951ae8add855f34e8.exe
- Size
  
  43KB
- MD5
  
  fa4c4ac8b9c1b14951ae8add855f34e8
- SHA1
  
  c5049dbdee3aaaf3a794edda02554789a25389bf
- SHA256
  
  bf6e5f9d060ebc5bb70144ca6e795bfc249c6590ab9f45e258ec9b5f3d49eeb6
- SHA512
  
  6d9d53cc430ea73684ec3c2e739d7dc01b7ce601a4a9073b77baf39d1f3e25ccc6d3f50a2e9b8bbaa275b8045cac370163d4e5a6a98aa736ca2c69b9820cee37
Score

10^/10

ransomware exorcist persistence
- Exorcist
  Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
  ransomware exorcist
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Enumerates connected drives
- Modifies service
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarepersistence

behavioral2

ransomwarepersistence