xorist | 5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c

General

Target

5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c.exe
Size

70KB
Sample

210419-x2brzda4kx
MD5

0a6cc2a5fd2701a3d80cca1438c4950d
SHA1

260f28d8fde4bccee35b4c5a80568ca431e13435
SHA256

5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c
SHA512

e70ce320f088aec289b9ae8c5ed539d6f10581544b53a23053746514744f51556c8fcdb193f6c88421b1bc22e5bdfd1270c5048e9fb8da391e5dcc0d2a157152

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\HOW TO DECRYPT FILES.txt

Ransom Note

your network has been infected due to improper browsing with infected html :( * all data has been locked with a unique key and has become .btCry_zip :( * without the unique key, it is impossible to bring your data to the state of origin :( * with the exclusive key in hand, it takes 20 minutes to unlock your data :) * you can get this key for just a fee. contact us email: btcontact@protonmail.com send id along with email id-67588824752785452767452345237499285 PS: * do not rename or change the extension of the files, as this will corrupt the renamed file : ( * no need to format or reinstall Windows :) * do not post this message on a third party website, as they will block the only contact email :( as proof of trust send me a file of up to 1 mb which i will return to you in its original state :)))) contact us until 04/13/2021

Emails

btcontact@protonmail.com

Targets

- Target
  
  5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c.exe
- Size
  
  70KB
- MD5
  
  0a6cc2a5fd2701a3d80cca1438c4950d
- SHA1
  
  260f28d8fde4bccee35b4c5a80568ca431e13435
- SHA256
  
  5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c
- SHA512
  
  e70ce320f088aec289b9ae8c5ed539d6f10581544b53a23053746514744f51556c8fcdb193f6c88421b1bc22e5bdfd1270c5048e9fb8da391e5dcc0d2a157152
Score

10^/10

persistence ransomware spyware stealer xorist
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2