Overview

overview

10

Static

static

excorsist.bin.exe

windows7_x64

10

excorsist.bin.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    excorsist.bin.zip

  • Size

    36KB

  • Sample

    201001-qag4hak1ta

  • MD5

    d58f419a1e057da01890865a79657424

  • SHA1

    b17ef18c6a147162ca246054db70c817a30ab845

  • SHA256

    768b40ceafed20055bbc60418929e8ec52fe3d1935caa1405af01e775d03e5e1

  • SHA512

    5c2c2e0506d1e13b331cc39d74064190a9744fba0dd40c844917111a7f2ccc1b4cef8b6a01aab7f89a912bfde2b83622159cb047d2e8e33038cdfd9ad8e5990d

Score
10/10
exorcistpersistenceransomware

Malware Config

Targets

    • Target

      excorsist.bin

    • Size

      68KB

    • MD5

      9e5c89c84cdbf460fc6857c4e32dafdf

    • SHA1

      ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d

    • SHA256

      dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

    • SHA512

      6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8

    Score
    10/10
    ransomwareexorcistpersistence

    • Exorcist Ransomware

      Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

      ransomwareexorcist

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks