Overview

overview

10

Static

static

3

d9789bfbc5...18.exe

windows11-21h2-x64

10

Resubmissions

09-12-2024 12:05

241209-n9axra1paj 10

09-12-2024 12:02

241209-n7ne3a1nen 4

09-12-2024 12:01

241209-n7c94a1nek 3

09-12-2024 12:01

241209-n6t68a1ncr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241209-n5y4sa1nar_pw_infected.zip

  • Size

    23KB

  • Sample

    241209-n6t68a1ncr

  • MD5

    341e29f1e0cc1d9fbfd3c7fc53d41c48

  • SHA1

    b21f1f27b41f686285a21e84cc731eb02ec6fc47

  • SHA256

    4ce9095a92d1112eed2fdf1ffaf6d9c007224203037dd0b8a3a20e7fcb10f015

  • SHA512

    d5d6bea413dc9d9aba5001c6f3bb6854e831faa2719c7e2076319a7802efbde1e51909408e138788fed7b409fad2979f7c6ad8f4c07ce4cfea25e92ba2ffde2f

  • SSDEEP

    384:YBh3pkxBVIvRFHqvf4UOeg8Vbt8s7eD7XB1vD2IeDEnpEtzCfPSyOUxaAjxxUvcb:YB0baSH4UVg8xtr7ePRV2IQ++tz+PqKh

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118

    • Size

      33KB

    • MD5

      d9789bfbc54d5cb6d52c385fd8f5d288

    • SHA1

      b8f60c64c70f03c263bf9e9261aa157a73864aaf

    • SHA256

      c0fcf3ac6b125e985c6574ed7ef1a7929f3be8f6487b68e4d58a48a3b1517b5d

    • SHA512

      21e81d64136897e86362304666cb0a8510ae2280c432c8b768875d5459b527e2cdafe9a61107433d3ff7ccf8092f3bbc226f9366623c1d39f76445fc490dc4c8

    • SSDEEP

      768:IPXirrjYZp0Tf6yFz5Om5jPwxgjAqJTKV/Z:I/iTYHQCm5DpjhJTKVR

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (1949) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks