Overview

overview

10

Static

static

10

f4c61dd324...18.exe

windows7-x64

10

f4c61dd324...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4c61dd3244e63b3a19d97a893e0cd60_JaffaCakes118

  • Size

    7KB

  • Sample

    241215-trx78ayret

  • MD5

    f4c61dd3244e63b3a19d97a893e0cd60

  • SHA1

    9df83615080a3bda80f91135a4d345e8055be5e3

  • SHA256

    676903c100dc93681f6812043ad2c4b1481680d18dfe36e27ed21a052150a9f6

  • SHA512

    9ff12f990bf81d0b3896e47a60704400b1581056e40a47debac6115fe0d9e45731fb6e28774eac4d2108c242a2ee9b6d3d87c1c4458ed1a8fa60e91afccd06af

  • SSDEEP

    192:Ewzdrr1FG1WDCgmjPZLs8xqE/5eRGMUA:Ewprr1gkDCgS2kesMB

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      f4c61dd3244e63b3a19d97a893e0cd60_JaffaCakes118

    • Size

      7KB

    • MD5

      f4c61dd3244e63b3a19d97a893e0cd60

    • SHA1

      9df83615080a3bda80f91135a4d345e8055be5e3

    • SHA256

      676903c100dc93681f6812043ad2c4b1481680d18dfe36e27ed21a052150a9f6

    • SHA512

      9ff12f990bf81d0b3896e47a60704400b1581056e40a47debac6115fe0d9e45731fb6e28774eac4d2108c242a2ee9b6d3d87c1c4458ed1a8fa60e91afccd06af

    • SSDEEP

      192:Ewzdrr1FG1WDCgmjPZLs8xqE/5eRGMUA:Ewprr1gkDCgS2kesMB

    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2205) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks