Overview

overview

10

Static

static

10

VSNKLGuzoF...2).exe

windows7-x64

3

VSNKLGuzoF...5w.exe

windows7-x64

3

VideoCodeCX.exe

windows7-x64

10

WcsPlugInS...ex.exe

windows7-x64

5

WinLocker Builder.exe

windows7-x64

5

WinLocker_Builder.exe

windows7-x64

5

_003E0000.exe.vir.exe

windows7-x64

9

vmem02.exe

windows7-x64

3

w8i9eHkHOwWwQlX.exe

windows7-x64

3

wpbt0.exe

windows7-x64

10

xpiofrbtkzhr.exe

windows7-x64

xxx_video (2).exe

windows7-x64

7

xxx_video.exe

windows7-x64

5

xxx_video_...vi.exe

windows7-x64

10

xxx_video_...ir.exe

windows7-x64

10

xxx_video_...ir.exe

windows7-x64

10

xxx_video_...ir.exe

windows7-x64

10

xxx_video_...vi.exe

windows7-x64

10

xxx_video_...ir.exe

windows7-x64

10

zcrypt.exe

windows7-x64

7

{71257279-...a}.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Batch_11.zip

  • Size

    3.9MB

  • MD5

    d9efba6b5d8f5cadcb5b72a261364879

  • SHA1

    847e175e807b9f271cfecdf0b451d029bdf73d5a

  • SHA256

    f6a83e6ed8bf92b8ff4da0aba72fe354199ec79a99008b34800e4cfdb92d3a67

  • SHA512

    ed9ae302a89f3aea8f749e804ed6b058f7d4a48e39ac3ef7d5d8e28eebbbe8a35f9ce7b7675ed57c968eade8ec29580cf37ac85f9aee9c56595b1662e6acaa60

  • SSDEEP

    98304:ywQRPA4p9xWgZgAAqLIld4nSUYuNmH6z3rcq/fsQ:yTST47mW7c4

Score
10/10
upxxorist

Malware Config

Signatures

  • Detected Xorist Ransomware 1 IoCs
  • Xorist family
    xorist
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

Files

  • Batch_11.zip
    .zip
  • VSNKLGuzoFJgFHyEI15w (2).exe
    .exe windows:5 windows x86 arch:x86

    d409d04619f830ed4fb4696d607103fa


    Headers

    Imports

    Sections

  • VSNKLGuzoFJgFHyEI15w.exe
    .exe windows:5 windows x86 arch:x86

    d409d04619f830ed4fb4696d607103fa


    Headers

    Imports

    Sections

  • VideoCodeCX.exe
    .exe windows:5 windows x86 arch:x86

    fdc840a7a99c43c34a60188ec8cc1596


    Headers

    Imports

    Sections

  • WcsPlugInService.ex.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • WinLocker Builder.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • WinLocker_Builder.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • _003E0000.exe.vir.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • vmem02.exe
    .exe windows:1 windows x86 arch:x86

    a208ed6b0434bcbf2b456ccd3a72195d


    Headers

    Imports

    Sections

  • w8i9eHkHOwWwQlX.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • wpbt0.dll
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • xpiofrbtkzhr.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • xxx_video (2).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • xxx_video.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_26726.avi.exe
    .exe windows:7 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:7 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_35942.avi.exe.vir.exe
    .exe windows:9 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:9 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_35942.avi_unpacked_.exe.vir.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_73240.avi____.exe.vir.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_77498.avi.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • xxx_video_87279.avi.exe.vir.exe
    .exe windows:9 windows x86 arch:x86


    Headers

    Sections

  • zcrypt.exe
    .exe windows:6 windows x86 arch:x86

    7c6791cb1b3ac992063bd8ecc38e1226


    Headers

    Imports

    Sections

  • {71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
    .exe windows:5 windows x86 arch:x86

    7e8ad4139efc6cbcf31df3bc4b291dd8


    Headers

    Imports

    Sections