Overview

overview

10

Static

static

10

cfbc736d5a...18.exe

windows7-x64

10

cfbc736d5a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118

  • Size

    7KB

  • Sample

    241207-ah69zsvqds

  • MD5

    cfbc736d5a16198f13e7bf360e5004be

  • SHA1

    4aea5ace463590c5c2bd1cc571851e5e630d9331

  • SHA256

    397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c

  • SHA512

    59a51ab1bcc070ae20e385e56ba2d0afe9e4ee6088cfe06e1de9c0d33cb4afe6ca55a92f6d137209b0cbf4a19eb2601ea4085e40e0a5d1e224e1993350d604ab

  • SSDEEP

    192:Gzdrr1FG1WDCgmjPZPx2ds9ct1X0utLRMUA:Gprr1gkDCgSCd6ct+gFMB

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118

    • Size

      7KB

    • MD5

      cfbc736d5a16198f13e7bf360e5004be

    • SHA1

      4aea5ace463590c5c2bd1cc571851e5e630d9331

    • SHA256

      397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c

    • SHA512

      59a51ab1bcc070ae20e385e56ba2d0afe9e4ee6088cfe06e1de9c0d33cb4afe6ca55a92f6d137209b0cbf4a19eb2601ea4085e40e0a5d1e224e1993350d604ab

    • SSDEEP

      192:Gzdrr1FG1WDCgmjPZPx2ds9ct1X0utLRMUA:Gprr1gkDCgSCd6ct+gFMB

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2169) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks