Overview

overview

10

Static

static

3

7427b0a089...a8.exe

windows7-x64

10

7427b0a089...a8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7427b0a0899935dad2b8c2537c927ca8.bin

  • Size

    66KB

  • Sample

    230702-b2lm3aac37

  • MD5

    7427b0a0899935dad2b8c2537c927ca8

  • SHA1

    12107e241724be0c980664691d96567e49b75ed0

  • SHA256

    a2417b27f08b82ae02c02f8d77484f3bbda0864215e3854318836bdd78470e96

  • SHA512

    10502ea49e9121a1b5f96ab490dac60cf524e0170c9bba1fb7f25f0f33ad329d32c15fa51a8d8e45dd979ba0ba45de75de0590f1418a45196beb999a0ed7ccec

  • SSDEEP

    768:qHe5kp8x6IXIBsXtql6h2tQHUvlXKY4kpLDwUzc80gmq3oP/oDU:aikp8xHgl6Itjk90r/0O8/ow

Score
10/10
nitropersistenceransomware

Malware Config

Targets

    • Target

      7427b0a0899935dad2b8c2537c927ca8.bin

    • Size

      66KB

    • MD5

      7427b0a0899935dad2b8c2537c927ca8

    • SHA1

      12107e241724be0c980664691d96567e49b75ed0

    • SHA256

      a2417b27f08b82ae02c02f8d77484f3bbda0864215e3854318836bdd78470e96

    • SHA512

      10502ea49e9121a1b5f96ab490dac60cf524e0170c9bba1fb7f25f0f33ad329d32c15fa51a8d8e45dd979ba0ba45de75de0590f1418a45196beb999a0ed7ccec

    • SSDEEP

      768:qHe5kp8x6IXIBsXtql6h2tQHUvlXKY4kpLDwUzc80gmq3oP/oDU:aikp8xHgl6Itjk90r/0O8/ow

    Score
    10/10
    nitropersistenceransomware

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks