Overview

overview

10

Static

static

10

svhitsa.exe

windows7-x64

10

svhitsa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4b8368d6d524f70a91dcdab4db707f0_JaffaCakes118

  • Size

    5KB

  • Sample

    241130-esckkswmdl

  • MD5

    b4b8368d6d524f70a91dcdab4db707f0

  • SHA1

    15734e26de0723d7caba733f47c22c5c713cac72

  • SHA256

    d014fe2e7f352ab44ad2a92dfeaec304e3d0aea22dab6c86c185dd96dbe20b0f

  • SHA512

    3738d0b8370f04cf514a1a41fe21c489309f61c65816a705fdf2d684d05528329763c48208a829e1c98b1dccb8ed85b4754dd66611245ccb0e331672d5a65a80

  • SSDEEP

    96:VIZVrD7N6Ox/lqwMr5cICP86pzoxl0vAY2NRCEgtrZrg/SGr4YVO8afqspzA1A:aZy6/lDmGICk6p8xuV2SEMrZMBssO8iF

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      svhitsa.exe

    • Size

      7KB

    • MD5

      06a9c10159921f27917d59c473adf1a5

    • SHA1

      b1f3252512aae364126de0c7047d3830778c2094

    • SHA256

      06f6b90aa9db58d3a1c0223397a3c2ad3e59cdb313462df903374030897aacc4

    • SHA512

      a62fdb6e18586f382d78c5ed51f3952c86cd9a533505cdb83f42beaad90fbc4c4651f53f86e75e5ab5cd1cfb1a77051081d2260a9a9674a2e22afa93cda99325

    • SSDEEP

      96:ltZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExqoXAU6hARhTjq16lX3c:Tzdrr1FG1WDCgmjPZFXnNJX3YvubMUA

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2168) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks