xorist | d3d53f9f2532b7fabbd75f06c46f9e53aae2b01a5455039375e58457118a9c8a

General

Target

9209074778.zip
Size

40KB
Sample

230221-n2ldhsef98
MD5

4a5757268b4092888d356752f9c08c69
SHA1

fe609e6a0b803a777cacd32313ab06ce36491293
SHA256

d3d53f9f2532b7fabbd75f06c46f9e53aae2b01a5455039375e58457118a9c8a
SHA512

06b9e9f6e6277438ebec6b856056b2a0deb2bb892ceae94c7f00bc8a50394939b7ee6b923998f5d2cb8442210324f0d02dac91092f0a16ea4d6f14ce3a2b348b
SSDEEP

768:9h78qHxmftWZg9Ri+Asa1dTxoZ+AtmJ50aQPy71pVQB+DmgY4ziKfeoHvr0:/pRmftWai+A3Fx6+AtmJ50aQPyh3QB+2

Score

10^/10

Malware Config

Targets

- Target
  
  8fbb2c5c20d0a00d1c4ba43d5209e6e3871b98207b03f1aa7483476c1355a12f
- Size
  
  70KB
- MD5
  
  dc21484e6789296fd8909c2534955a26
- SHA1
  
  d93e201935263c143eb4328479e46075096cb9ea
- SHA256
  
  8fbb2c5c20d0a00d1c4ba43d5209e6e3871b98207b03f1aa7483476c1355a12f
- SHA512
  
  ceb82b90d543a2e1d5f3ad922b5d211095653fe91371f72f9034d5c99821ed1a1022d737f8b11708982ec021ea913f15e4a37342f5df7517e45994a93faf40df
- SSDEEP
  
  768:/rVDC0PDYPR+P+3CYOyyEStf0wmWQgoUqwo8IwGKd3ybg7lyL10XI3Ou4sqwL/U/:/r4NR+tYdHSsWQdJ9EEJ3CwfiViKvt
Score

10^/10

xorist persistence ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Xorist Ransomware

Xorist Ransomware

Drops file in Drivers directory

Drops startup file

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2