nitro | 6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9 | Triage

Sharing

General

Target

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
Size

173KB
Sample

221120-p4lyhade79
MD5

cb01abb8d6243fb221a9ad82b045f8d5
SHA1

1de449599b00a296444dba9fae178e3ebab11fcf
SHA256

6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9
SHA512

a99f74a0a8ffd788ecf328415703148c798df1fb058a427d55aebd6bba429f75dffeb74613503834e29bb911f5f46381327ec4656e26a56d5ac57c7617698323
SSDEEP

1536:DYXaUsozJCno/PhFqy+iLU2oxF7pbbeAkOppZfS/Eo:DYjhIyv4F7pPeAkOppw/t

Score

10^/10

nitro persistence ransomware

Malware Config

Targets

- Target
  
  6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9.exe
- Size
  
  173KB
- MD5
  
  cb01abb8d6243fb221a9ad82b045f8d5
- SHA1
  
  1de449599b00a296444dba9fae178e3ebab11fcf
- SHA256
  
  6695641abf1570268dcfcc3728d35eff3857c1b5e43b0a4ac151522797759fb9
- SHA512
  
  a99f74a0a8ffd788ecf328415703148c798df1fb058a427d55aebd6bba429f75dffeb74613503834e29bb911f5f46381327ec4656e26a56d5ac57c7617698323
- SSDEEP
  
  1536:DYXaUsozJCno/PhFqy+iLU2oxF7pbbeAkOppZfS/Eo:DYjhIyv4F7pPeAkOppw/t
Score

10^/10

nitro persistence ransomware
- Nitro
  A ransomware that demands Discord nitro gift codes to decrypt files.
  ransomware nitro
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

nitropersistenceransomware

behavioral2

nitropersistenceransomware