Overview

overview

10

Static

static

10

c777c39aa8...18.exe

windows7-x64

10

c777c39aa8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c777c39aa89562d749c232c53baa5b47_JaffaCakes118

  • Size

    7KB

  • Sample

    241205-njfqbaslfs

  • MD5

    c777c39aa89562d749c232c53baa5b47

  • SHA1

    45861a873bf82a97ed122680a33d80d17437f51b

  • SHA256

    888e8c884608c66d3b71bd2440ee643f6fc8b416d63e4d3a79a614c6203abc58

  • SHA512

    bf51be15f0d8c36011af9ce834f22b3682401ece3d637c57f8983ee1c9bd535ec4bc20f0f7cc7724f7e92be12cbc28843c0f4e6fff1ce72116617ec23305b936

  • SSDEEP

    96:WdZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx1kUqhx/qMUA:Ezdrr1FG1WDCgmjPZSx/qMUA

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      c777c39aa89562d749c232c53baa5b47_JaffaCakes118

    • Size

      7KB

    • MD5

      c777c39aa89562d749c232c53baa5b47

    • SHA1

      45861a873bf82a97ed122680a33d80d17437f51b

    • SHA256

      888e8c884608c66d3b71bd2440ee643f6fc8b416d63e4d3a79a614c6203abc58

    • SHA512

      bf51be15f0d8c36011af9ce834f22b3682401ece3d637c57f8983ee1c9bd535ec4bc20f0f7cc7724f7e92be12cbc28843c0f4e6fff1ce72116617ec23305b936

    • SSDEEP

      96:WdZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx1kUqhx/qMUA:Ezdrr1FG1WDCgmjPZSx/qMUA

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2193) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks