Overview

overview

10

Static

static

3

b013b979c5...31.exe

windows7-x64

10

b013b979c5...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b013b979c5af00f1bf252afd94595a5adfd0a88e53267d7c17c9e89d18ec4b31.exe

  • Size

    9.3MB

  • Sample

    240713-nrspva1ema

  • MD5

    1af347b1b2623db94b2989c2a484f478

  • SHA1

    e51910554a9f8cc0af056abf449ca176389ebc4d

  • SHA256

    b013b979c5af00f1bf252afd94595a5adfd0a88e53267d7c17c9e89d18ec4b31

  • SHA512

    0ee008b67bbba078c7a8ed526492a32416f0d33ad825a4b9d382d570847dff8202775b5cfd4e6a137d8bb06ea3fc184fdc6d88cc472e69f2417dcbf252de5472

  • SSDEEP

    196608:1/owwGS5r7uSEjLucA1Qr+nXEU/NCevTkIFOylylEv6rcV/sH/b:2DdrSSEjLTA1Qrs1NCevwIFkaEfb

Score
10/10
xoristpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      b013b979c5af00f1bf252afd94595a5adfd0a88e53267d7c17c9e89d18ec4b31.exe

    • Size

      9.3MB

    • MD5

      1af347b1b2623db94b2989c2a484f478

    • SHA1

      e51910554a9f8cc0af056abf449ca176389ebc4d

    • SHA256

      b013b979c5af00f1bf252afd94595a5adfd0a88e53267d7c17c9e89d18ec4b31

    • SHA512

      0ee008b67bbba078c7a8ed526492a32416f0d33ad825a4b9d382d570847dff8202775b5cfd4e6a137d8bb06ea3fc184fdc6d88cc472e69f2417dcbf252de5472

    • SSDEEP

      196608:1/owwGS5r7uSEjLucA1Qr+nXEU/NCevTkIFOylylEv6rcV/sH/b:2DdrSSEjLTA1Qrs1NCevwIFkaEfb

    Score
    10/10
    xoristpersistenceransomwarespywarestealer

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2526) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks