Extracted

• • Target

    0d148218983f96167795e70053b0960d5a501a30b3c45e626e9228af49af2248.exe

  • Size

    4.7MB

  • MD5

    1df3028b6a1e41a393bb542df2274145

  • SHA1

    332899d8f3e304a4447bc7256bbc127c34303291

  • SHA256

    0d148218983f96167795e70053b0960d5a501a30b3c45e626e9228af49af2248

  • SHA512

    a73115bb838839a1a0a2e4033265422e37eba53cbd295277f5139a1a223bbd2cc3381355069269943f82f834cb6eeec36c5b41c7ab98fa89b9fce03903003308

  • SSDEEP

    98304:jbxXg98fQNhyC+Dt1RA9hgpG3qhWXLpSwlzf9UT7fJ/sBo4:jp1fQNhN0EgpTWXLpS8ZGx/sBo4

  Score

  10^/10

  xoristransomwarespywarestealervmprotect

  • Detected Xorist Ransomware

  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Renames multiple (5486) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3