Overview

overview

10

Static

static

3

DiscordNitroGen.exe

windows7-x64

10

DiscordNitroGen.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DiscordNitroGen.exe

  • Size

    60KB

  • Sample

    230805-17gzhafa25

  • MD5

    1086e604bdc2930920fcb35f8237522c

  • SHA1

    b5219f22e37266ecc867cc6ea8af22a4e18ba5e2

  • SHA256

    58bd3bfdd4b83aaa9f723ee5c4a5d22b434074d7ad03f4729aba8ca7d6bb4cba

  • SHA512

    68ac7fc8603ebc209c906385c1f80bb266ce238711e3cd667559265f83a378da0ae0a5653f9027e1ac3c20f7c792a60efa8ccc0da1ef09051bc359dd214b36fc

  • SSDEEP

    768:ZOucKn7n1JGDfANIUIJ8LDwUzc80gmq3oP/oDT:ZO2GDfAPJr/0O8/o/

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      DiscordNitroGen.exe

    • Size

      60KB

    • MD5

      1086e604bdc2930920fcb35f8237522c

    • SHA1

      b5219f22e37266ecc867cc6ea8af22a4e18ba5e2

    • SHA256

      58bd3bfdd4b83aaa9f723ee5c4a5d22b434074d7ad03f4729aba8ca7d6bb4cba

    • SHA512

      68ac7fc8603ebc209c906385c1f80bb266ce238711e3cd667559265f83a378da0ae0a5653f9027e1ac3c20f7c792a60efa8ccc0da1ef09051bc359dd214b36fc

    • SSDEEP

      768:ZOucKn7n1JGDfANIUIJ8LDwUzc80gmq3oP/oDT:ZO2GDfAPJr/0O8/o/

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks