Overview

overview

10

Static

static

10

8fbb2c5c20...2f.exe

windows7-x64

10

8fbb2c5c20...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3d53f9f2532b7fabbd75f06c46f9e53aae2b01a5455039375e58457118a9c8a

  • Size

    40KB

  • Sample

    240419-wzcbtsbh26

  • MD5

    4a5757268b4092888d356752f9c08c69

  • SHA1

    fe609e6a0b803a777cacd32313ab06ce36491293

  • SHA256

    d3d53f9f2532b7fabbd75f06c46f9e53aae2b01a5455039375e58457118a9c8a

  • SHA512

    06b9e9f6e6277438ebec6b856056b2a0deb2bb892ceae94c7f00bc8a50394939b7ee6b923998f5d2cb8442210324f0d02dac91092f0a16ea4d6f14ce3a2b348b

  • SSDEEP

    768:9h78qHxmftWZg9Ri+Asa1dTxoZ+AtmJ50aQPy71pVQB+DmgY4ziKfeoHvr0:/pRmftWai+A3Fx6+AtmJ50aQPyh3QB+2

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      8fbb2c5c20d0a00d1c4ba43d5209e6e3871b98207b03f1aa7483476c1355a12f

    • Size

      70KB

    • MD5

      dc21484e6789296fd8909c2534955a26

    • SHA1

      d93e201935263c143eb4328479e46075096cb9ea

    • SHA256

      8fbb2c5c20d0a00d1c4ba43d5209e6e3871b98207b03f1aa7483476c1355a12f

    • SHA512

      ceb82b90d543a2e1d5f3ad922b5d211095653fe91371f72f9034d5c99821ed1a1022d737f8b11708982ec021ea913f15e4a37342f5df7517e45994a93faf40df

    • SSDEEP

      768:/rVDC0PDYPR+P+3CYOyyEStf0wmWQgoUqwo8IwGKd3ybg7lyL10XI3Ou4sqwL/U/:/r4NR+tYdHSsWQdJ9EEJ3CwfiViKvt

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks