Overview

overview

10

Static

static

3

NitroRanso...xe.exe

windows7-x64

10

NitroRanso...xe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NitroRansomwareexe.exe

  • Size

    1.7MB

  • Sample

    230705-nv8kgaca22

  • MD5

    4c76a86d5ae0b97c0aeb685ef0669b2e

  • SHA1

    f82d664141c1aca3942f939491e36ed4d86e0167

  • SHA256

    60727ce041da619eb4071fcf13de92d9f8ea9f21741782e3ead14117a63cc5b3

  • SHA512

    c41cfe498dc52a5810836a91842b3632af9831747d9bfd6cf7dbdd9301e330f88592f78cdf8e4473fdd38bd0c974c306775f93a77e21bbd809ee36675626f350

  • SSDEEP

    49152:UowYGwfZPnlXMTdngwwHv5VbtHw1kqXfd+/9AE:UoVDZdcNgNhVRw1kqXf0F

Score
10/10
nitroevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      NitroRansomwareexe.exe

    • Size

      1.7MB

    • MD5

      4c76a86d5ae0b97c0aeb685ef0669b2e

    • SHA1

      f82d664141c1aca3942f939491e36ed4d86e0167

    • SHA256

      60727ce041da619eb4071fcf13de92d9f8ea9f21741782e3ead14117a63cc5b3

    • SHA512

      c41cfe498dc52a5810836a91842b3632af9831747d9bfd6cf7dbdd9301e330f88592f78cdf8e4473fdd38bd0c974c306775f93a77e21bbd809ee36675626f350

    • SSDEEP

      49152:UowYGwfZPnlXMTdngwwHv5VbtHw1kqXfd+/9AE:UoVDZdcNgNhVRw1kqXf0F

    Score
    10/10
    evasionpersistencetrojannitroransomware

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks