xorist | 307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b

General

Target

307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.bin.sample
Size

14KB
Sample

230124-zt3tdafd8x
MD5

4a42f739ce694db7b3cdd3c233ce7fb1
SHA1

68fcc99e719b57308c9b1b3d4eef91dec62d02e5
SHA256

307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b
SHA512

15137fdc43519be2e83346d7a07c84d439e4da22e328722cb3da6bf1bcfbf584b2594901582ddf6ea363ae515e37cb1f32c407a8ebfe747a13562de927f92f54
SSDEEP

384:0prr1gkDCgSZ75pbB7E68AvXIHqe939g83FMENKsB:arVDCp/h8QIOwiO

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\HOW TO DECRYPT FILES.txt

Ransom Note

All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encrtyption was produced using unique KEY generated for this computer. To decrypted files, you need to otbtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet; The server will destroy the key within 24 hours after encryption completed. Payment have to be made in maxim 24 hours To retrieve the private key, you need to pay 3 BITCOINS Bitcoins have to be sent to this address: 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK After you've sent the payment send us an email to : [email protected] with subject : ERROR-ID-63100778(3BITCOINS) If you are not familiar with bitcoin you can buy it from here : SITE : www.localbitcoin.com After we confirm the payment , we send the private key so you can decrypt your system.

Emails

[email protected]

Wallets

1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK

Targets

- Target
  
  307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.bin.sample
- Size
  
  14KB
- MD5
  
  4a42f739ce694db7b3cdd3c233ce7fb1
- SHA1
  
  68fcc99e719b57308c9b1b3d4eef91dec62d02e5
- SHA256
  
  307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b
- SHA512
  
  15137fdc43519be2e83346d7a07c84d439e4da22e328722cb3da6bf1bcfbf584b2594901582ddf6ea363ae515e37cb1f32c407a8ebfe747a13562de927f92f54
- SSDEEP
  
  384:0prr1gkDCgSZ75pbB7E68AvXIHqe939g83FMENKsB:arVDCp/h8QIOwiO
Score

10^/10

xorist persistence ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2