xorist | d331be81ce523afe71ade8bdbe7ce584b730ccaf4f1677919954c31a6a58ab6e | Triage

Sharing

General

Target

8a3eff6a421f7cc91089e356b8ac5f0d_JaffaCakes118
Size

12KB
Sample

241103-h4tj1sxqbz
MD5

8a3eff6a421f7cc91089e356b8ac5f0d
SHA1

c02a10b7182cafecb3386986f500f811112190fd
SHA256

d331be81ce523afe71ade8bdbe7ce584b730ccaf4f1677919954c31a6a58ab6e
SHA512

50b8d59a40f23b32d02cd22aead6f78eb35c05281f2fea4ab95f9a04cf56d2eaa420fa4551915e92a4be66bbb5cb668c277d25e22e9066a4a4943522aa95af79
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCWiV2h:eebFNw4Pk1itKkpAjjI2YpdmCFV2

Score

10^/10

xorist discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  8a3eff6a421f7cc91089e356b8ac5f0d_JaffaCakes118
- Size
  
  12KB
- MD5
  
  8a3eff6a421f7cc91089e356b8ac5f0d
- SHA1
  
  c02a10b7182cafecb3386986f500f811112190fd
- SHA256
  
  d331be81ce523afe71ade8bdbe7ce584b730ccaf4f1677919954c31a6a58ab6e
- SHA512
  
  50b8d59a40f23b32d02cd22aead6f78eb35c05281f2fea4ab95f9a04cf56d2eaa420fa4551915e92a4be66bbb5cb668c277d25e22e9066a4a4943522aa95af79
- SSDEEP
  
  192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCWiV2h:eebFNw4Pk1itKkpAjjI2YpdmCFV2
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (2207) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer