Overview

overview

10

Static

static

3

NitroRansomware.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NitroRansomware.exe

  • Size

    1.0MB

  • Sample

    230701-mjanmahg71

  • MD5

    508fa08b6a8141eab4879deffa71ccf0

  • SHA1

    21de90995b69eab1ad5806e4b72a592551b9e215

  • SHA256

    efa29372d0ee3db391cdfe6dfce1fe28733d760de3b11811ca6455a7e944324d

  • SHA512

    cf9648a41831b3033f276efcc684d3de4559f061b198f07b17a2e6c45745ec13747d66c8aa25f5686a80c5ee5be5e7377681de26bae7f2c2d0e50dea43646e8d

  • SSDEEP

    24576:S4YGGjodngwtlaHxN8KUWVe6tw2wvKhLnFB:S4YG2odngwwHv5VbtHw

Score
10/10
nitroevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      NitroRansomware.exe

    • Size

      1.0MB

    • MD5

      508fa08b6a8141eab4879deffa71ccf0

    • SHA1

      21de90995b69eab1ad5806e4b72a592551b9e215

    • SHA256

      efa29372d0ee3db391cdfe6dfce1fe28733d760de3b11811ca6455a7e944324d

    • SHA512

      cf9648a41831b3033f276efcc684d3de4559f061b198f07b17a2e6c45745ec13747d66c8aa25f5686a80c5ee5be5e7377681de26bae7f2c2d0e50dea43646e8d

    • SSDEEP

      24576:S4YGGjodngwtlaHxN8KUWVe6tw2wvKhLnFB:S4YG2odngwwHv5VbtHw

    Score
    10/10
    nitroevasionpersistenceransomwaretrojan

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • UAC bypass

      evasiontrojan

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks