Overview

overview

10

Static

static

10

841f52f43c...83.exe

windows7-x64

10

841f52f43c...83.exe

windows10-2004-x64

10

out.exe

windows7-x64

3

out.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.exe

  • Size

    7KB

  • Sample

    230411-1z37rsfg38

  • MD5

    a29fc50d11f97997ce0c38ecd238355e

  • SHA1

    52e21efa1477c1bd269eddd91ae0a13d3e47e835

  • SHA256

    841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83

  • SHA512

    a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55

  • SSDEEP

    192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83.exe

    • Size

      7KB

    • MD5

      a29fc50d11f97997ce0c38ecd238355e

    • SHA1

      52e21efa1477c1bd269eddd91ae0a13d3e47e835

    • SHA256

      841f52f43cebec8602fee5688e076a6a24128fcd35969e85f9d921d467634d83

    • SHA512

      a10afe7db8b8773f3fb8d728abb0b748a6dd6b41ef045f66eda00eaf09ea9603147c5477c3a56bf65add3716001a493880db50e93522d305e61db198284fde55

    • SSDEEP

      192:nzdrr1FG1WDCgmjPZEysGsXpFHL99oMUA:nprr1gkDCgS+dGWpFHL9KMB

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      out.upx

    • Size

      12KB

    • MD5

      9f2641e2be0637cd75d5c2e2e66a75eb

    • SHA1

      e70165b932b7672b9d57d1524fee773aa0141e09

    • SHA256

      bfe433c431dc2066dadfc3e5b167f4d8755cfcca15a5ca06211ef082739331ea

    • SHA512

      b738dd7d7be084ae73a7a4d05a4ee7a1e6a201cbd68092f5bde74512ddb142e85a33b6174ea6f32547e12f89dffe901587e8c2134f874f2b7036a1441bd676fc

    • SSDEEP

      192:R/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjnfPtRMMMUA0:RebFNw4Pk1itKkpAjjgMMB0

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks