xorist | 09ebad56d4a58d367a7b44d41029bab85eb556de21e49e2ad91884e94c9bd31d

General

Target

9236223525.zip
Size

103KB
Sample

230221-n2hbvsge7z
MD5

cb255677750b445152be5798a1382e38
SHA1

498f445a465d22ab2c3cee7cdd36487068135569
SHA256

09ebad56d4a58d367a7b44d41029bab85eb556de21e49e2ad91884e94c9bd31d
SHA512

de1b06f92892f7782c2c7a9db119035c8d2dbc6f8ffe2794152f02a48d5d831493ef0cdfe7bb41cda71de45fd04de07f0b8be82410425ce318c0426c8327cc8e
SSDEEP

3072:p/MSk6pIEuqP1K/rZBqOU+GdmU4kUqvy5D2Nhtn5Z74NWi6:p/MopI1VDZQdmU4kvi+hB5ZL7

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

Ransom Note

ATTENTION! All your files have been encrypted And their decryption will cost you 0.06 bitcoin. To start the decryption process follow the steps below Step 1) Make sure you send 0.06 bitcoin to this wallet: bc1q73lm30rgv6h9wy42y88t0r8prjh9l9pzpvvm9c Step 2) Contact me at this email address: [email protected] With this Subject: KORYA-KEYPC-938192806 After the payment has been confirmed, you will receive the decryptor and the keys for decryption! Other information: If you don't own bitcoin, you can buy it here very easily www.coinmama.com www.bitpanda.com www.localbitcoins.com www.paxful.com You can find a larger list here: https://bitcoin.org/en/exchanges If the payment is not made in 2 days, I will consider that you do not want to decrypt your files, and therefore the keys generated for your PC will be permanently.deleted.

Emails

[email protected]

Targets

- Target
  
  b2447bb9ef759c890d75e31eb07f0553065d74403f654c9757635b02f1b753be
- Size
  
  194KB
- MD5
  
  38861549ebf043bc397f47726943a067
- SHA1
  
  bba10fb61d0dbeb6d99e779d6b452fa0d4fe09a3
- SHA256
  
  b2447bb9ef759c890d75e31eb07f0553065d74403f654c9757635b02f1b753be
- SHA512
  
  30d3c812d28ef4d0b23ebcb27a17b48ffc6d8ae16d52ef188f2336956252fc4ec85773c80e8ffa34047952badb1977a6e0ac297d6694343fead66287233b9006
- SSDEEP
  
  3072:DUQjXKWZCnEGsA2SgRxwgHX+MB7+4TFo/ahEFAI2I4z4:vjaWZY4VRygDBa4qFzpP
Score

10^/10

xorist persistence ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2