xorist | e4d2f2a378d94e261a8379699d8eba2f814afd6b8d4fb75eae9acb8135e245f6

General

Target

dffc0f2532e126df17e0c34e17a7b35a_JaffaCakes118
Size

7KB
Sample

241211-fpf92axqes
MD5

dffc0f2532e126df17e0c34e17a7b35a
SHA1

1ee624026bec1f2bb3b5aa26b19dd59ebd7655ad
SHA256

e4d2f2a378d94e261a8379699d8eba2f814afd6b8d4fb75eae9acb8135e245f6
SHA512

9b3b51e0cd7d8bcc4ca254b1dcc21061a72e95d3501317238ff8b8f766470d574a126b8c7b778a982babea93964debb69a0f94b992503c8085fadab230a94dee
SSDEEP

96:VLZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExiAiY2lUJbTLIQi9z+L0:1zdrr1FG1WDCgmjPZi1fWTlgzWnMUA

Score

10^/10

Malware Config

Targets

- Target
  
  dffc0f2532e126df17e0c34e17a7b35a_JaffaCakes118
- Size
  
  7KB
- MD5
  
  dffc0f2532e126df17e0c34e17a7b35a
- SHA1
  
  1ee624026bec1f2bb3b5aa26b19dd59ebd7655ad
- SHA256
  
  e4d2f2a378d94e261a8379699d8eba2f814afd6b8d4fb75eae9acb8135e245f6
- SHA512
  
  9b3b51e0cd7d8bcc4ca254b1dcc21061a72e95d3501317238ff8b8f766470d574a126b8c7b778a982babea93964debb69a0f94b992503c8085fadab230a94dee
- SSDEEP
  
  96:VLZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExiAiY2lUJbTLIQi9z+L0:1zdrr1FG1WDCgmjPZi1fWTlgzWnMUA
Score

10^/10

xorist adware discovery persistence privilege_escalation ransomware spyware stealer upx
- Detected Xorist Ransomware
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Xorist family
  xorist
- Renames multiple (5475) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2