Extracted

• • Target

    NitroRansomware.exe

  • Size

    1.7MB

  • MD5

    6e4c9fe77dd12b68a62fb669bc33224e

  • SHA1

    dc6c3b8e5f286834071b5cc649395d2e5a7cf29d

  • SHA256

    9a3e5872a07bf6b187b184764bab6b4e199b3de9c83454632911038d76cb2024

  • SHA512

    c32526c1aaa2435d20c08ec34459830ea5788713795e237b396e80e8b6ba435873c338864eb2eda18f33eb9adfe1a7bb4984c0d051b75c69a6518bc3e2aebfb5

  • SSDEEP

    49152:zRmYGwfZPnlXgNuTdngwwHv5VbtHw1kqXfd+/9A:zRnDZdQNuNgNhVRw1kqXf0F

  Score

  10^/10

  nitroevasionpersistenceransomwaretrojan

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

    ransomwarenitro

  • UAC bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1