Overview

overview

10

Static

static

10

d64442e8a7...18.exe

windows7-x64

10

d64442e8a7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d64442e8a7be93d9483ed74af2e9550f_JaffaCakes118

  • Size

    7KB

  • Sample

    241208-k2q28atpdp

  • MD5

    d64442e8a7be93d9483ed74af2e9550f

  • SHA1

    5a5961f9a16626698d7d02638b6b3eb1794b96a0

  • SHA256

    7238a977cd928a62fb7979092573daf2f0ae471d58dad1706e684a7612a8e4e6

  • SHA512

    d800407caa400ca1dd875e77d286d76c4663041618cfafde8f4c9f7ab46aa0473aa1158aa5cb6d3aeb11eeda89eedcecc03ea872b9cb93f16b77c99bca062622

  • SSDEEP

    96:lLZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx7+HpFXWLThxfeGMUA:pzdrr1FG1WDCgmjPZ7+HpFXCxmGMUA

Score
10/10
xoristdiscoveryransomwarespywarestealerupx

Malware Config

Targets

    • Target

      d64442e8a7be93d9483ed74af2e9550f_JaffaCakes118

    • Size

      7KB

    • MD5

      d64442e8a7be93d9483ed74af2e9550f

    • SHA1

      5a5961f9a16626698d7d02638b6b3eb1794b96a0

    • SHA256

      7238a977cd928a62fb7979092573daf2f0ae471d58dad1706e684a7612a8e4e6

    • SHA512

      d800407caa400ca1dd875e77d286d76c4663041618cfafde8f4c9f7ab46aa0473aa1158aa5cb6d3aeb11eeda89eedcecc03ea872b9cb93f16b77c99bca062622

    • SSDEEP

      96:lLZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx7+HpFXWLThxfeGMUA:pzdrr1FG1WDCgmjPZ7+HpFXCxmGMUA

    Score
    10/10
    xoristdiscoveryransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2212) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks