General
- Target ea5f8513249e95e37e6af52548f78adf29f561710fe678cbfee6e3bdb2e02718
- Size 7KB
- Sample260812-pergpawfmd
- SHA256 ea5f8513249e95e37e6af52548f78adf29f561710fe678cbfee6e3bdb2e02718
Score
10/10
Malware Config
Targets
-
- Target 1c195d273ccf2fbe86c66af4c0b5db5f6e2c4c4dc331b0b0e24d32f2ef57d9fa.exe
- Size 9KB
- SHA256 1c195d273ccf2fbe86c66af4c0b5db5f6e2c4c4dc331b0b0e24d32f2ef57d9fa
Score10/10-
Detected Xorist Ransomware
-
Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Renames multiple (2350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.