Overview

overview

10

Static

static

3

NitroRansomware.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NitroRansomware.exe

  • Size

    1.3MB

  • Sample

    230702-25yd5sfb2s

  • MD5

    d8bc15d7823c0db0882be71f853ce8f7

  • SHA1

    b17969bbc6826d6d33ab6ca6b9cfad0af46d6ec8

  • SHA256

    c853ee6eb1abf28eab76d035f1b5b5548563f375f0f98335aa0853e8a66181b3

  • SHA512

    222926d57978c16b6ad3b7a487c3c862f932e5dd734e6e889026996fcb37b2168dd205f29201549dad5c7955775e6b3b8bf5f960df06504419ed5369de082c2a

  • SSDEEP

    24576:WNYGGwodngwtlaHxN8KUWVe6tw2wvKhLnekqjVnlqud+/2P+AP3:WNYGjodngwwHv5VbtHw1kqXfd+/9A

Score
10/10
nitroevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      NitroRansomware.exe

    • Size

      1.3MB

    • MD5

      d8bc15d7823c0db0882be71f853ce8f7

    • SHA1

      b17969bbc6826d6d33ab6ca6b9cfad0af46d6ec8

    • SHA256

      c853ee6eb1abf28eab76d035f1b5b5548563f375f0f98335aa0853e8a66181b3

    • SHA512

      222926d57978c16b6ad3b7a487c3c862f932e5dd734e6e889026996fcb37b2168dd205f29201549dad5c7955775e6b3b8bf5f960df06504419ed5369de082c2a

    • SSDEEP

      24576:WNYGGwodngwtlaHxN8KUWVe6tw2wvKhLnekqjVnlqud+/2P+AP3:WNYGjodngwwHv5VbtHw1kqXfd+/9A

    Score
    10/10
    nitroevasionpersistenceransomwaretrojan

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks