Overview

overview

10

Static

static

10

bdf4b45b79...18.exe

windows7-x64

10

bdf4b45b79...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdf4b45b79f51b912c6d4bc0bddb1d05_JaffaCakes118

  • Size

    94KB

  • Sample

    241203-shxpnazphs

  • MD5

    bdf4b45b79f51b912c6d4bc0bddb1d05

  • SHA1

    543b673e22bcb465fc6e0a957c359bd573244d71

  • SHA256

    87dcfd522eef81f58e0b18db800cdd28562ba537f1d00bb48658c21e68521a63

  • SHA512

    fdfda6bb4de2b81cd3dc9870d74adf5bab67a756dbefc5b132bf189e10db4c827cbbb3c7dd4cfaf7870aeb71fae6729ffe85cb3b8eeed1d4a82bf454b7f5d728

  • SSDEEP

    1536:aPOUQrHbMsZM/ugmK82XqcTc5BkUXO6X/1qV/ZjxgHpByhbBiduD8RRYzZI05:tUQ/MsZ4B99XqcgDVvWgnZkD+yzZH5

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      bdf4b45b79f51b912c6d4bc0bddb1d05_JaffaCakes118

    • Size

      94KB

    • MD5

      bdf4b45b79f51b912c6d4bc0bddb1d05

    • SHA1

      543b673e22bcb465fc6e0a957c359bd573244d71

    • SHA256

      87dcfd522eef81f58e0b18db800cdd28562ba537f1d00bb48658c21e68521a63

    • SHA512

      fdfda6bb4de2b81cd3dc9870d74adf5bab67a756dbefc5b132bf189e10db4c827cbbb3c7dd4cfaf7870aeb71fae6729ffe85cb3b8eeed1d4a82bf454b7f5d728

    • SSDEEP

      1536:aPOUQrHbMsZM/ugmK82XqcTc5BkUXO6X/1qV/ZjxgHpByhbBiduD8RRYzZI05:tUQ/MsZ4B99XqcgDVvWgnZkD+yzZH5

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2203) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks