xorist | 841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83

General

Target

841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample
Size

7KB
Sample

230124-zt42fadg49
MD5

a29fc50d11f97997ce0c38ecd238355e
SHA1

52e21efa1477c1bd269eddd91ae0a13d3e47e835
SHA256

841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83
SHA512

a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55
SSDEEP

192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB

Score

10^/10

Malware Config

Targets

- Target
  
  841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.bin.sample
- Size
  
  7KB
- MD5
  
  a29fc50d11f97997ce0c38ecd238355e
- SHA1
  
  52e21efa1477c1bd269eddd91ae0a13d3e47e835
- SHA256
  
  841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83
- SHA512
  
  a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55
- SSDEEP
  
  192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB
Score

10^/10

xorist persistence ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Xorist Ransomware

Xorist Ransomware

Drops file in Drivers directory

Modifies extensions of user files

UPX packed file

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2