nitro | 166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3 | Triage

Sharing

General

Target

HEUR-Trojan-Ransom.Win32.Generic-166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
Size

61KB
Sample

220925-e5ynkseeeq
MD5

e06246e30ae66a2dd4de85270947dbb7
SHA1

02e99b245f2734020334f80504710db43a141fea
SHA256

166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3
SHA512

03b426b28eb2f3f6c800d70ae19fbd0e897d4f1c4537659a2eb9f31ffc5789062b3576f18059f3f2e51f064edce1865c39572aacdd133b9486b71837efab8790
SSDEEP

768:oKsMqCXfVcWGpuuM9ZkiANIUI2YLDwUzc80gmq3oP/oDE:oKseG1M9ZkiAPQr/0O8/oQ

Score

10^/10

nitro persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  HEUR-Trojan-Ransom.Win32.Generic-166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3.exe
- Size
  
  61KB
- MD5
  
  e06246e30ae66a2dd4de85270947dbb7
- SHA1
  
  02e99b245f2734020334f80504710db43a141fea
- SHA256
  
  166f41385bf95bc7de1dedecd9d2288c7d185dfce0fa1848595c53a5339c95f3
- SHA512
  
  03b426b28eb2f3f6c800d70ae19fbd0e897d4f1c4537659a2eb9f31ffc5789062b3576f18059f3f2e51f064edce1865c39572aacdd133b9486b71837efab8790
- SSDEEP
  
  768:oKsMqCXfVcWGpuuM9ZkiANIUI2YLDwUzc80gmq3oP/oDE:oKseG1M9ZkiAPQr/0O8/oQ
Score

10^/10

persistence spyware stealer nitro ransomware
- Nitro
  A ransomware that demands Discord nitro gift codes to decrypt files.
  ransomware nitro
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Defacement

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

nitropersistenceransomwarespywarestealer