xorist | 786b540920417403510c05ae05001136739ac44ea08edc2db8431e18040ec87b | Triage

Sharing

General

Target

9b4de172aa632a204daa8e8ff75f6826_JaffaCakes118
Size

133KB
Sample

241125-n18ses1qen
MD5

9b4de172aa632a204daa8e8ff75f6826
SHA1

da1f7578984a964b73d1730ab01d24aed19fd0e3
SHA256

786b540920417403510c05ae05001136739ac44ea08edc2db8431e18040ec87b
SHA512

1dd22971bae63e51a80c3250b86debfdb1fa28097d4abd05a6c51f0602b0cc1ba9ccfb0cfac922a5efd5ab3cf941b229d0f8577fad2dcc714da245684abf9b2e
SSDEEP

3072:AkRd05tGFPerij5RMDLELd0LIkpnNb5M8CZLJpVh1Mx2:ANt+PeGR++eNF3Cd1h1Mx2

Score

10^/10

xorist discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  9b4de172aa632a204daa8e8ff75f6826_JaffaCakes118
- Size
  
  133KB
- MD5
  
  9b4de172aa632a204daa8e8ff75f6826
- SHA1
  
  da1f7578984a964b73d1730ab01d24aed19fd0e3
- SHA256
  
  786b540920417403510c05ae05001136739ac44ea08edc2db8431e18040ec87b
- SHA512
  
  1dd22971bae63e51a80c3250b86debfdb1fa28097d4abd05a6c51f0602b0cc1ba9ccfb0cfac922a5efd5ab3cf941b229d0f8577fad2dcc714da245684abf9b2e
- SSDEEP
  
  3072:AkRd05tGFPerij5RMDLELd0LIkpnNb5M8CZLJpVh1Mx2:ANt+PeGR++eNF3Cd1h1Mx2
Score

10^/10

xorist discovery ransomware spyware stealer
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Xorist family
  xorist
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xoristdiscoveryransomwarespywarestealer

behavioral2

xoristdiscoveryransomware