Overview

overview

10

Static

static

10

5b8a07d4d8...18.exe

windows7-x64

10

5b8a07d4d8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b8a07d4d891c996d088a41a04bf9dd5_JaffaCakes118

  • Size

    7KB

  • Sample

    241019-jfs41swgkq

  • MD5

    5b8a07d4d891c996d088a41a04bf9dd5

  • SHA1

    8a812bc22eeb96c6252006480613b04793a62b36

  • SHA256

    d0f0f1cb764de7a366baa6a5dd8fb330557728e95f8c31e8a90d749983f5983b

  • SHA512

    596ec5a51e01b75e23580c0428fb756744829c51fc586d27be87036ac00f49e94a5c11d97f8bc57dfb2a150fba30e5dd8b795c552d8fb02bf686214dfb613e83

  • SSDEEP

    96:W+KZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExNm/PuaVAnPmaMUA:2zdrr1FG1WDCgmjPZN3aVAPmaMUA

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      5b8a07d4d891c996d088a41a04bf9dd5_JaffaCakes118

    • Size

      7KB

    • MD5

      5b8a07d4d891c996d088a41a04bf9dd5

    • SHA1

      8a812bc22eeb96c6252006480613b04793a62b36

    • SHA256

      d0f0f1cb764de7a366baa6a5dd8fb330557728e95f8c31e8a90d749983f5983b

    • SHA512

      596ec5a51e01b75e23580c0428fb756744829c51fc586d27be87036ac00f49e94a5c11d97f8bc57dfb2a150fba30e5dd8b795c552d8fb02bf686214dfb613e83

    • SSDEEP

      96:W+KZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExNm/PuaVAnPmaMUA:2zdrr1FG1WDCgmjPZN3aVAPmaMUA

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupxdiscovery

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (2216) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks