xorist | a0be3e6abffc484860a4ea261cfd5218b2fec9164fdff1318556b0665afcf6f3 | Triage

Sharing

General

Target

e9d71f80f9e44314a81f97542939b75b_JaffaCakes118
Size

12KB
Sample

241213-et5yhsyjay
MD5

e9d71f80f9e44314a81f97542939b75b
SHA1

b7041704a6b9c4f62efb0e21013e0cf265eb54d2
SHA256

a0be3e6abffc484860a4ea261cfd5218b2fec9164fdff1318556b0665afcf6f3
SHA512

5643e2ff53f757f63780cec40e9ccea9bd4ecd5e8030059ebf28956cc1095ae3855cbb16a1f4af334f661cd3d6ffbac5c66eab0615fb548bcd3f64c9b496fb1a
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCT:eebFNw4Pk1itKkpAjjI2YpdmC

Score

10^/10

xorist discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  e9d71f80f9e44314a81f97542939b75b_JaffaCakes118
- Size
  
  12KB
- MD5
  
  e9d71f80f9e44314a81f97542939b75b
- SHA1
  
  b7041704a6b9c4f62efb0e21013e0cf265eb54d2
- SHA256
  
  a0be3e6abffc484860a4ea261cfd5218b2fec9164fdff1318556b0665afcf6f3
- SHA512
  
  5643e2ff53f757f63780cec40e9ccea9bd4ecd5e8030059ebf28956cc1095ae3855cbb16a1f4af334f661cd3d6ffbac5c66eab0615fb548bcd3f64c9b496fb1a
- SSDEEP
  
  192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCT:eebFNw4Pk1itKkpAjjI2YpdmC
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (2162) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer