xorist | 5d6b3313ec04f0c4609110f8985d5a305d05640f1ca83c40b6b912356bec3558

General

Target
2026-10-05_c072219a0db397d6ddd8e78d656df03a_elex_mortalkombat_xorist
Size 12KB
Sample261006-hshclsdf26
SHA256 5d6b3313ec04f0c4609110f8985d5a305d05640f1ca83c40b6b912356bec3558
MD5 c072219a0db397d6ddd8e78d656df03a
SHA1 f91463849c2789f0c068292eaa2b796091a5955b
SHA512 c034e1dbec1295a151841f63cf02491e9b32030456629ef231d0d99a97175b373e4c3de7b64d4aac707aed62f9de7bbd20c6140a51d4329489bcf555c64a38ee
SSDEEP 192:6/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMtq9pdul:6ebFNw4Pk1itKkpAjjI2Ypdmtq9pd8
TLSH
T1A442290FFDD444E7D611C6F223172609CB7DB262A6B067216FA82C14187AAE7EF6450F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-05_c072219a0db397d6ddd8e78d656df03a_elex_mortalkombat_xorist
- Size 12KB
- SHA256 5d6b3313ec04f0c4609110f8985d5a305d05640f1ca83c40b6b912356bec3558
- MD5 c072219a0db397d6ddd8e78d656df03a
- SHA1 f91463849c2789f0c068292eaa2b796091a5955b
- SHA512 c034e1dbec1295a151841f63cf02491e9b32030456629ef231d0d99a97175b373e4c3de7b64d4aac707aed62f9de7bbd20c6140a51d4329489bcf555c64a38ee
- SSDEEP 192:6/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMtq9pdul:6ebFNw4Pk1itKkpAjjI2Ypdmtq9pd8
- TLSH
  T1A442290FFDD444E7D611C6F223172609CB7DB262A6B067216FA82C14187AAE7EF6450F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xorist persistence privilege_escalation ransomware spyware stealer
- Detected Xorist Ransomware
- Family: Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- Detects ransomware indicator
- Renames multiple (2329) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2