xorist | 99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf[.]bin[.]sample[.]gz

General

Target
99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf.bin.sample.gz
Size 173KB
Sample221209-j23kkscf87
SHA256 90b23c1d63e4c8653e17a75f0eb2921b5190b6635fa49effe00e06d429f6d7a2
MD5 916755125005fc1c26769b7b64f95f7a
SHA1 ac004fd4d3273eca3af2fb472a101d243ae68938
SHA512 74da91c2f9ab50c57a5ddaec36eaf2517917f24eecdffa4374107c93e4c53dd694f50b435743ec918af6ede3dee7edb0e61ae06ff35abe1cdff5ad77fa510bfe
SSDEEP 3072:VI18XaYt1UOKaIEvqQLRIJoUGuEv1hpRP86EjWwb4tQSBsF5Ho9/E:VIiKIUNEvqQFISsQnP8jWwgBu5HQ/E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx xorist

Malware Config

Signatures

Detected Xorist Ransomware 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	family_xorist

Xorist family
xorist

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/sample	upx

File Explorer

99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf.bin.sample.gz

.gz 173KB
sample

.exe 265KB
out.upx

.exe 1.2MB

99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf.bin.sample.gz

SHA256 90b23c1d63e4c8653e17a75f0eb2921b5190b6635fa49effe00e06d429f6d7a2
MD5 916755125005fc1c26769b7b64f95f7a
SHA1 ac004fd4d3273eca3af2fb472a101d243ae68938
SHA512 74da91c2f9ab50c57a5ddaec36eaf2517917f24eecdffa4374107c93e4c53dd694f50b435743ec918af6ede3dee7edb0e61ae06ff35abe1cdff5ad77fa510bfe
SSDEEP 3072:VI18XaYt1UOKaIEvqQLRIJoUGuEv1hpRP86EjWwb4tQSBsF5Ho9/E:VIiKIUNEvqQFISsQnP8jWwgBu5HQ/E
MD5 SHA1 SHA512 SSDEEP

sample

SHA256 99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf
MD5 edb9ba4dec60f2fbabe50db587ed035b
SHA1 43ba0dc628d76092dd409a6d21f81e5045ddd24f
SHA512 7931e66b5c7fe59981835623f4fef3228aed943b49f3b44b1ad8831f28e9f8be8b1be82e1564fa33a843352345f95405198ba89c98bc3e62622b3ab081c7ecfc
SSDEEP 3072:hUQoKIo3zkikzwVNYWGN6ozfnQxct3VCyuVMAAbMIcEWSRgdOdLOfTg:Ryojkia2pGNbZ3EvVxIcEmOdM
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

1240832

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 2029fe9a46d4fd4aabbc1d5e221d7d847956b8d3151442343142e26fdf74f6a1
MD5 4a4b750f43d60eb6762109b19d2671a9
SHA1 2c23284f397088f5b1565551857dbe2b7064a4ae
SHA512 69d838d96e622fb0f78a7c265978fa7f38c1429cde39ceb03f9a0bc7c2ffe40b8db036b31385831f36d124c1fc9cd4c3df2e4c4829ea8e2f7d26fe9a3f8b30fb
SSDEEP 3072:sRgdOdLOfTgo26FtRieGX63skUzXJaqdkIsdI5cxOxRrInT0hOh6/s:ZOdMPFPzig+ZS4cxkrQTdh6/
MD5 SHA1 SHA512 SSDEEP