Extracted

• • Target
    Setup
  • Size 68KB
  • SHA256 dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620
  • MD5 9e5c89c84cdbf460fc6857c4e32dafdf
  • SHA1 ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d
  • SHA512 6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8
  • MD5 SHA1 SHA512

  Score

  10^/10

  ransomwareexorcistpersistence

  • Exorcist Ransomware

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    ransomwareexorcist

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service

    persistence
  behavioral1behavioral2