Overview

overview

10

Static

static

Counter Fuck.exe

windows7_x64

10

Counter Fuck.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Counter Fuck.exe

  • Size

    145KB

  • Sample

    220123-d5pv1aeed3

  • MD5

    35d5df687d9a6512c66a5ea593173ec8

  • SHA1

    8e6be0c9756048f635fc4faa3fbe76a0ed77923e

  • SHA256

    0a0b9434dff488eaf2f57c3923e03a603c9367445eaae1b5c71e6a79fc95c999

  • SHA512

    1d1d95dfd651ed0fd69432c4c4f807ab61b86756f38b64b12bce1a8e1415ad3d916f36d69e138156c1f9e430351af826dc515001cff6ed8ccf40b8643094d63b

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      Counter Fuck.exe

    • Size

      145KB

    • MD5

      35d5df687d9a6512c66a5ea593173ec8

    • SHA1

      8e6be0c9756048f635fc4faa3fbe76a0ed77923e

    • SHA256

      0a0b9434dff488eaf2f57c3923e03a603c9367445eaae1b5c71e6a79fc95c999

    • SHA512

      1d1d95dfd651ed0fd69432c4c4f807ab61b86756f38b64b12bce1a8e1415ad3d916f36d69e138156c1f9e430351af826dc515001cff6ed8ccf40b8643094d63b

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks