Overview

overview

10

Static

static

10

20edc5b6ec...18.exe

windows7-x64

10

20edc5b6ec...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20edc5b6ec17558d46853bd4bfadc69b_JaffaCakes118

  • Size

    165KB

  • Sample

    241008-lynncszflm

  • MD5

    20edc5b6ec17558d46853bd4bfadc69b

  • SHA1

    3689bdf4ad7163ad1e876e312cf807ba1c5f1ff7

  • SHA256

    b0ff77903804ee3d866b81ff8b94be59dad33721475d56812da9e9850beadfba

  • SHA512

    bf8c52c7da40c93ec388846745ed5d1603f3712b9b1d6fe2960aaacb89270995a16514b82d0956f0954747cc15f832162fe03ece56fcd6c18b1d01e41410dedd

  • SSDEEP

    3072:Tr0zyJStHyynWJs4JrboEjTdrqwGDSSF3+LTNt9NKJKIX:T4UStSyWjvBqwGXqNt9Niv

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      20edc5b6ec17558d46853bd4bfadc69b_JaffaCakes118

    • Size

      165KB

    • MD5

      20edc5b6ec17558d46853bd4bfadc69b

    • SHA1

      3689bdf4ad7163ad1e876e312cf807ba1c5f1ff7

    • SHA256

      b0ff77903804ee3d866b81ff8b94be59dad33721475d56812da9e9850beadfba

    • SHA512

      bf8c52c7da40c93ec388846745ed5d1603f3712b9b1d6fe2960aaacb89270995a16514b82d0956f0954747cc15f832162fe03ece56fcd6c18b1d01e41410dedd

    • SSDEEP

      3072:Tr0zyJStHyynWJs4JrboEjTdrqwGDSSF3+LTNt9NKJKIX:T4UStSyWjvBqwGXqNt9Niv

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2212) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks