Overview

overview

10

Static

static

10

9abc767640...18.exe

windows7-x64

10

9abc767640...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9abc7676409e2b51f85f790a682a0e72_JaffaCakes118

  • Size

    39KB

  • Sample

    241125-lscc5swrbn

  • MD5

    9abc7676409e2b51f85f790a682a0e72

  • SHA1

    0bc0a2f357bdb10f3fe1ea9a62b3db70486741fe

  • SHA256

    fa437ba32cfb9a0adeaaa29e05d45a4dad3125494ed2f6cdf184244203d70448

  • SHA512

    86945d6a2774d959c696b6a4907395b5f0efde716e897a9cdc82bae89f2025cb857a2c00b55c3a07ad1721aa0e964e37277d3d2153b009db8942a7a4029e6d4b

  • SSDEEP

    384:QebFNw4Pk1itKkpAjjalrrVuqYvjSXkDCgSkORSmaMB:Q0FmBkpKjaV9Y73DCi2

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      9abc7676409e2b51f85f790a682a0e72_JaffaCakes118

    • Size

      39KB

    • MD5

      9abc7676409e2b51f85f790a682a0e72

    • SHA1

      0bc0a2f357bdb10f3fe1ea9a62b3db70486741fe

    • SHA256

      fa437ba32cfb9a0adeaaa29e05d45a4dad3125494ed2f6cdf184244203d70448

    • SHA512

      86945d6a2774d959c696b6a4907395b5f0efde716e897a9cdc82bae89f2025cb857a2c00b55c3a07ad1721aa0e964e37277d3d2153b009db8942a7a4029e6d4b

    • SSDEEP

      384:QebFNw4Pk1itKkpAjjalrrVuqYvjSXkDCgSkORSmaMB:Q0FmBkpKjaV9Y73DCi2

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2537) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks