Overview

overview

10

Static

static

10

ScreenCapt...r1.exe

windows7-x64

1

ScreenCapt...r2.exe

windows7-x64

1

ScreenCapt...rt.exe

windows7-x64

1

ScreenCapt...er.exe

windows7-x64

1

ScreenCapt...ck.exe

windows7-x64

1

ScreenCapt...k1.exe

windows7-x64

1

ScreenCapt...k2.exe

windows7-x64

1

Setup (5).exe

windows7-x64

7

Setup (6).exe

windows7-x64

7

Supplement...16.scr

windows7-x64

3

T1.exe

windows7-x64

10

T1_b7afca7...b5.exe

windows7-x64

10

TeenTube_90767.exe

windows7-x64

10

Trojan-Ran....a.exe

windows7-x64

3

Tuyen bo c...ed.doc

windows7-x64

4

Tuyen bo c...ed.doc

windows7-x64

4

UNPACKED.exe

windows7-x64

9

Uninstall (2).exe

windows7-x64

3

Uninstall.exe

windows7-x64

3

Upx.exe

windows7-x64

5

screenshot2016.exe

windows7-x64

7

sidacertification.exe

windows7-x64

3

spora.exe

windows7-x64

10

svhost.exe

windows7-x64

10

sys100s.exe_.exe

windows7-x64

9

tordll.dll

windows7-x64

3

uacbypass.exe

windows7-x64

3

unpack.exe

windows7-x64

10

unpacked.ex_.exe

windows7-x64

9

unpacked.mem.exe

windows7-x64

10

upd.exe

windows7-x64

6

verhdiehndi.bat

windows7-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Batch_10.zip

  • Size

    11.3MB

  • MD5

    b48fdef3291bb0abc112131cf87a8e15

  • SHA1

    3a4cd49e66c6e38ca69fd6f6a6f494518ab76136

  • SHA256

    5015af8fb5725c4c9ebac28a890128587b888acddab6cc9ff06e94e782713882

  • SHA512

    3e8bda530a228eea7c36c7dd66b22f28d72a819408f2f8c1bd68fc9e73665293d4c09b562f09a4e6c79e77ac43539389dddb1e71a8e8b996a187c83821281dda

  • SSDEEP

    196608:wtlLvswtv/acQbMgxSrvVK23tcrz00PonBnI9qJBd/fFD5:Ulzf3anbMgxMvVKOtEz0hnyiF9

Score
10/10
macroupxxorist

Malware Config

Signatures

  • Detected Xorist Ransomware 2 IoCs
  • Xorist family
    xorist
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 29 IoCs

    Checks for missing Authenticode signature.

Files

  • Batch_10.zip
    .zip
  • ScreenCapture_Win8.MalwareScanner1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.MalwareScanner2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.PopupAlert.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.TaskServer.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.WindowsLock.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.WindowsLock1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ScreenCapture_Win8.WindowsLock2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Setup (5).exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Setup (6).exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Supplementary Agreement 26_01_2016.scr
    .exe windows:5 windows x86 arch:x86

    67ef42078ff0fa6e633d4e8d0e87faba


    Headers

    Imports

    Sections

  • T1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • T1_b7afca788487347804156f052c613db5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TeenTube_90767.exe
    .exe windows:5 windows x86 arch:x86

    3c98c11017e670673be70ad841ea9c37


    Headers

    Imports

    Sections

  • Trojan-Ransom.Win32.Telecrypt.a.exe
    .exe windows:5 windows x86 arch:x86

    e798bfb56516c458d97e60d4f0e3cc29


    Headers

    Imports

    Exports

    Sections

  • Tuyen bo chung Viet Nam - Hoa Ky - Infected and EnCrypted.doc
    .doc windows office2003

    qkG

  • Tuyen bo chung Viet Nam - Hoa Ky - Infected.doc
    .doc windows office2003

    qkG

  • UNPACKED.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Uninstall (2).exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Upx.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • screenshot2016.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • sidacertification.exe
    .exe windows:5 windows x86 arch:x86

    b43ab9922bd8f3f897446b83c01766ec


    Headers

    Imports

    Sections

  • spora.exe
    .exe windows:4 windows x86 arch:x86

    35aa2b974d9de7285698747491ff55bd


    Headers

    Imports

    Sections

  • svhost.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • sys100s.exe_.exe
    .exe windows:5 windows x86 arch:x86

    553ef6236c6cb4268814330cd1e93c7d


    Headers

    Imports

    Sections

  • tordll.exe
    .dll windows:5 windows x86 arch:x86

    1a471d85332e7686dc0dd4655b883c67


    Headers

    Imports

    Exports

    Sections

  • uacbypass.exe
    .exe windows:5 windows x86 arch:x86

    74112afb67d4cb152ebd8ee76f449460


    Headers

    Imports

    Sections

  • unpack.dll
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • unpacked.ex_.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • unpacked.mem.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • upd.exe
    .exe windows:4 windows x86 arch:x86

    3c3f09494da36852fafc40ecc5f611a8


    Headers

    Imports

    Sections

  • verhdiehndi.bat