Overview

overview

10

Static

static

3

a2890ba6dc...18.exe

windows7-x64

10

a2890ba6dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2890ba6dc1a4f157914601efd000e9b_JaffaCakes118

  • Size

    52KB

  • Sample

    241126-r8syqawjhx

  • MD5

    a2890ba6dc1a4f157914601efd000e9b

  • SHA1

    f57d1cf4280f8ea09689479075f900efcfa3eac1

  • SHA256

    8d6765e6f817410d0bf153b7e17010d884c32c03f9fd87be54a29fb8d990a2a1

  • SHA512

    9de7c58c162ef216a1c4aea2b34ebbf27e13e5213af061772a0a526ae22d5cb7ecf6b79c278e15cf51ae6bf523a45cf9d825d442d81cd2cc88caf2fd14fa7020

  • SSDEEP

    768:9np9Xtie1hhTPIeU2ze8Rye+zYfiVIAbs5AtcoEPrGbfsctDg0ufUulatfR07Su8:9PXtiehPIeDRBkvUFKbnStlaVgSu2

Score
10/10
xoristdiscoveryransomwarespywarestealerupx

Malware Config

Targets

    • Target

      a2890ba6dc1a4f157914601efd000e9b_JaffaCakes118

    • Size

      52KB

    • MD5

      a2890ba6dc1a4f157914601efd000e9b

    • SHA1

      f57d1cf4280f8ea09689479075f900efcfa3eac1

    • SHA256

      8d6765e6f817410d0bf153b7e17010d884c32c03f9fd87be54a29fb8d990a2a1

    • SHA512

      9de7c58c162ef216a1c4aea2b34ebbf27e13e5213af061772a0a526ae22d5cb7ecf6b79c278e15cf51ae6bf523a45cf9d825d442d81cd2cc88caf2fd14fa7020

    • SSDEEP

      768:9np9Xtie1hhTPIeU2ze8Rye+zYfiVIAbs5AtcoEPrGbfsctDg0ufUulatfR07Su8:9PXtiehPIeDRBkvUFKbnStlaVgSu2

    Score
    10/10
    xoristdiscoveryransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2201) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks