Overview

overview

10

Static

static

10

309a8303b3...18.exe

windows7-x64

10

309a8303b3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    309a8303b385958cffe14970238f0ffa_JaffaCakes118

  • Size

    13KB

  • Sample

    241010-syqlaasfqd

  • MD5

    309a8303b385958cffe14970238f0ffa

  • SHA1

    ea36ae363736b33c28fdb123c762bea15f30bca4

  • SHA256

    20c010a4f163e1548d5654967452effb7ec18b60034077ff7b2ace4d39dfaa94

  • SHA512

    5ec1163786650a9a0abad0cd15c2e832c645b401885e756321ffb55f861faf53782e1947704d63ce1a2f616175ad8ef514916add3fe8c24f8c1d6d7961e19ad9

  • SSDEEP

    192:Azdrr1FG1WDCgmjPZQv1ifQYpT5xMa27OYYaOCIX5jj2J/e81rXFUA:Aprr1gkDCgSgIZpdxVg48rrXFB

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      309a8303b385958cffe14970238f0ffa_JaffaCakes118

    • Size

      13KB

    • MD5

      309a8303b385958cffe14970238f0ffa

    • SHA1

      ea36ae363736b33c28fdb123c762bea15f30bca4

    • SHA256

      20c010a4f163e1548d5654967452effb7ec18b60034077ff7b2ace4d39dfaa94

    • SHA512

      5ec1163786650a9a0abad0cd15c2e832c645b401885e756321ffb55f861faf53782e1947704d63ce1a2f616175ad8ef514916add3fe8c24f8c1d6d7961e19ad9

    • SSDEEP

      192:Azdrr1FG1WDCgmjPZQv1ifQYpT5xMa27OYYaOCIX5jj2J/e81rXFUA:Aprr1gkDCgSgIZpdxVg48rrXFB

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2207) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks