Overview

overview

10

Static

static

3

241209-n5y...ed.zip

windows11-21h2-x64

10

Resubmissions

09-12-2024 12:05

241209-n9axra1paj 10

09-12-2024 12:02

241209-n7ne3a1nen 4

09-12-2024 12:01

241209-n7c94a1nek 3

09-12-2024 12:01

241209-n6t68a1ncr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241209-n5y4sa1nar_pw_infected.zip

  • Size

    23KB

  • Sample

    241209-n9axra1paj

  • MD5

    341e29f1e0cc1d9fbfd3c7fc53d41c48

  • SHA1

    b21f1f27b41f686285a21e84cc731eb02ec6fc47

  • SHA256

    4ce9095a92d1112eed2fdf1ffaf6d9c007224203037dd0b8a3a20e7fcb10f015

  • SHA512

    d5d6bea413dc9d9aba5001c6f3bb6854e831faa2719c7e2076319a7802efbde1e51909408e138788fed7b409fad2979f7c6ad8f4c07ce4cfea25e92ba2ffde2f

  • SSDEEP

    384:YBh3pkxBVIvRFHqvf4UOeg8Vbt8s7eD7XB1vD2IeDEnpEtzCfPSyOUxaAjxxUvcb:YB0baSH4UVg8xtr7ePRV2IQ++tz+PqKh

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      241209-n5y4sa1nar_pw_infected.zip

    • Size

      23KB

    • MD5

      341e29f1e0cc1d9fbfd3c7fc53d41c48

    • SHA1

      b21f1f27b41f686285a21e84cc731eb02ec6fc47

    • SHA256

      4ce9095a92d1112eed2fdf1ffaf6d9c007224203037dd0b8a3a20e7fcb10f015

    • SHA512

      d5d6bea413dc9d9aba5001c6f3bb6854e831faa2719c7e2076319a7802efbde1e51909408e138788fed7b409fad2979f7c6ad8f4c07ce4cfea25e92ba2ffde2f

    • SSDEEP

      384:YBh3pkxBVIvRFHqvf4UOeg8Vbt8s7eD7XB1vD2IeDEnpEtzCfPSyOUxaAjxxUvcb:YB0baSH4UVg8xtr7ePRV2IQ++tz+PqKh

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2016) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks