General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-b09e0d502b9b512921e230c6f231c332c835134c39211266d3279871d6214420.exe
-
Size
61KB
-
Sample
220925-e6hzhsdcd9
-
MD5
c0d5c092b08dec24d255e0d686da9848
-
SHA1
c20d4772984d3b3fe570375c74becb5315be14f8
-
SHA256
b09e0d502b9b512921e230c6f231c332c835134c39211266d3279871d6214420
-
SHA512
7ebc6ea3f4c9c370ef40d1bbb09409acb1bc67d195520f59801f48f9261c4d560c93c0a4e8d13961e55f7a6274400cb0afb858453b35964352c4f46230dd20f1
-
SSDEEP
768:FKsMqCXfVcWO/M9ZkiANIUMDYLDwUzc80gmq3oP/oDW:FKseiM9ZkiAP3r/0O8/oq
Malware Config
Targets
-
-
Target
HEUR-Trojan-Ransom.Win32.Generic-b09e0d502b9b512921e230c6f231c332c835134c39211266d3279871d6214420.exe
-
Size
61KB
-
MD5
c0d5c092b08dec24d255e0d686da9848
-
SHA1
c20d4772984d3b3fe570375c74becb5315be14f8
-
SHA256
b09e0d502b9b512921e230c6f231c332c835134c39211266d3279871d6214420
-
SHA512
7ebc6ea3f4c9c370ef40d1bbb09409acb1bc67d195520f59801f48f9261c4d560c93c0a4e8d13961e55f7a6274400cb0afb858453b35964352c4f46230dd20f1
-
SSDEEP
768:FKsMqCXfVcWO/M9ZkiANIUMDYLDwUzc80gmq3oP/oDW:FKseiM9ZkiAP3r/0O8/oq
Score10/10-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-