Behavioral task
behavioral1
Sample
56f02c129554ebdb58371c23b105b2f1325692e6b9896947dba74e35b422c317.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
56f02c129554ebdb58371c23b105b2f1325692e6b9896947dba74e35b422c317.exe
Resource
win10v2004-20230220-en
General
-
Target
9207514463.zip
-
Size
79KB
-
MD5
80d330fd5fe1eb4229a0c0505cbad070
-
SHA1
872a0059726d7354d0197ba209733e195b16623b
-
SHA256
0f4bead1078d0165109355d520b28692173ebb6c23a1ee4b36d44a500e28c91a
-
SHA512
66d2aa22d0d579d3a8d313fac0066b672a38867bbe5332c4a4920d18502ba769e9b62a5a4cea965c4d2f5d7ffc424430f63169547383bb32763708e50e4bbc3b
-
SSDEEP
1536:hYBMJzKp9GrAGFHNm+xa0XOYxM9Rnkm/C9niotBuHxEHnBO1BQGYJs2:GUybGNl12Cnz78iHBOYGJ2
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
resource yara_rule static1/unpack001/56f02c129554ebdb58371c23b105b2f1325692e6b9896947dba74e35b422c317 family_xorist static1/unpack002/out.upx family_xorist -
Xorist family
-
resource yara_rule static1/unpack001/56f02c129554ebdb58371c23b105b2f1325692e6b9896947dba74e35b422c317 upx
Files
-
9207514463.zip.zip
Password: infected
-
56f02c129554ebdb58371c23b105b2f1325692e6b9896947dba74e35b422c317.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE