xorist | 4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f

General

Target

4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f
Size

346KB
Sample

220712-m5c1waaah2
MD5

99df60e4e6bd3497f40736a408dd0a46
SHA1

d02937c29a00c4d15fbcb19a9afd85a9ad3fce6b
SHA256

4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f
SHA512

aa902f62c05b5682209459d354dc70d243125612fff1000879b5ee0d32b58c8b503a140942376483ad41de4c4d29502bf3f3f92a4a910418f9af3b5cf6671f32

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\HOW TO DECRYPT FILES.txt

Ransom Note

YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED. DON'T WORRY YOUR FILES ARE SAFE. TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM. PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK. YOU CAN GET THEM VIA ATM MACHINE OR ONLINE https://coinatmradar.com/ (find a ATM) https://www.localbitcoins.com/ (buy instantly online any country) THE PRICE FOR DECRYPTOR SOFTWARE IS 0.8 BTC BTC ADRESS : 3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg (where you need to make the payment) VERRY IMPORTANT ! DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA . ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED. THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE. For more information : repair_data@scryptmail.com (24/7) Subject : SYSTEM-LOCKED-ID: 10191895

Emails

repair_data@scryptmail.com

Wallets

3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg

URLs

https://coinatmradar.com/

https://www.localbitcoins.com/

Targets

- Target
  
  4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f
- Size
  
  346KB
- MD5
  
  99df60e4e6bd3497f40736a408dd0a46
- SHA1
  
  d02937c29a00c4d15fbcb19a9afd85a9ad3fce6b
- SHA256
  
  4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f
- SHA512
  
  aa902f62c05b5682209459d354dc70d243125612fff1000879b5ee0d32b58c8b503a140942376483ad41de4c4d29502bf3f3f92a4a910418f9af3b5cf6671f32
Score

10^/10

xorist persistence ransomware spyware stealer
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2