xorist | 5de893b2e4e2ca63e3dfba1ca8fd57bb44b920fd25c1c6c720bb15c3bae45f12

General

Target

9240460920.zip
Size

40KB
Sample

230221-nx4djage51
MD5

1887e84a16365a8de7522804b86dac25
SHA1

f2f6edd89efa30cf81ce77e7b5b6787ef5401824
SHA256

5de893b2e4e2ca63e3dfba1ca8fd57bb44b920fd25c1c6c720bb15c3bae45f12
SHA512

c5e6ca653ad00341818aad0fdcd36aea3a8df85f80a999f010489bca71cd98feda5985181a0c6a7df3d901420a71c4e964c5e30c402ac06bceeb3d33c8e1b735
SSDEEP

768:eByxBsk5GPi2v797PnMJgS6mLPZqZJHYERvkKCHmJykqHhkbqmpK+fMYpqXp9tOP:tPsTPiO9TMJ9RLxCJ48CHmnEhL+fnU5e

Score

10^/10

Malware Config

Targets

- Target
  
  a93ee68a88babf80e9ea7af2f0c31115a98680d14af4a3ec6bcb60b7c6199533
- Size
  
  71KB
- MD5
  
  2579743d5d6f411afee80e1098227c25
- SHA1
  
  eb699525b239622757938423bf2c8e3b373978c5
- SHA256
  
  a93ee68a88babf80e9ea7af2f0c31115a98680d14af4a3ec6bcb60b7c6199533
- SHA512
  
  ac2581bf951241684b61fcc7e64cd6af6a471100a9dd1da00c7019bf67ddcdfa5221f06497b3a8b3119f05aa341a1f41f64340fbefc614792a88995b34787ff6
- SSDEEP
  
  768:orVDC3OYPR+P+3CYOyyEStf0wmWQgoUqwo8IwGKd3ybg7lyL10XI3Ou4sbwL/Umj:or4FR+tYdHSsWQdJ9EEJ3CpfiViKxt
Score

10^/10

xorist persistence ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Drops file in Drivers directory
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Xorist Ransomware

Xorist Ransomware

Drops file in Drivers directory

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2