Overview

overview

10

Static

static

10

d9a11e95c6...9c.exe

windows7-x64

10

d9a11e95c6...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9a11e95c6f0ca3172e93f161899f355153758153a874aedf696f6dfad54719c.exe

  • Size

    7KB

  • Sample

    230918-h2wllaff6t

  • MD5

    22e24db95c0a449699a4174444adf6c5

  • SHA1

    0656ad195e2721745f2e46b851e8e78f8f4e2ee4

  • SHA256

    d9a11e95c6f0ca3172e93f161899f355153758153a874aedf696f6dfad54719c

  • SHA512

    75080dc5dfcfb19bfa327035afeedd6f2ac957fd5e28c552d42a66fa008e2cf7bf4c62ca2a82433347c92e7079ca2a5fefb157751674f804f83b7f1e5c52796b

  • SSDEEP

    96:WJZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExFNw0mR7Dk3nzMUA:4zdrr1FG1WDCgmjPZ76kXzMUA

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      d9a11e95c6f0ca3172e93f161899f355153758153a874aedf696f6dfad54719c.exe

    • Size

      7KB

    • MD5

      22e24db95c0a449699a4174444adf6c5

    • SHA1

      0656ad195e2721745f2e46b851e8e78f8f4e2ee4

    • SHA256

      d9a11e95c6f0ca3172e93f161899f355153758153a874aedf696f6dfad54719c

    • SHA512

      75080dc5dfcfb19bfa327035afeedd6f2ac957fd5e28c552d42a66fa008e2cf7bf4c62ca2a82433347c92e7079ca2a5fefb157751674f804f83b7f1e5c52796b

    • SSDEEP

      96:WJZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExFNw0mR7Dk3nzMUA:4zdrr1FG1WDCgmjPZ76kXzMUA

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2146) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (2154) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks