Overview

overview

10

Static

static

10

11792ee86d...7a.exe

windows7-x64

10

11792ee86d...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11792ee86d2847e73686ec5530b120ed9cef93393290f147336866626cd5797a

  • Size

    3.5MB

  • Sample

    230822-kxcn2abb79

  • MD5

    ff838a6c4bd6a71f9067ea1aa685690a

  • SHA1

    2986ebc39727d52b72bd5489ef1806c299726055

  • SHA256

    11792ee86d2847e73686ec5530b120ed9cef93393290f147336866626cd5797a

  • SHA512

    60bbdeb286a28c5507cf32e488a25353f3e082cb66523ce83e2aa67935d4b4c5fa4e03b2a1553ead3d2abdb0d7731e18d0194b0348ccce42bf52f154a2a41235

  • SSDEEP

    98304:zDf+qQgWuqOeKQhHJH2ROwfKb9L4A+RY2Z58:zDIgWud/ipWROwf20AEZO

Score
10/10
medusalockernitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      11792ee86d2847e73686ec5530b120ed9cef93393290f147336866626cd5797a

    • Size

      3.5MB

    • MD5

      ff838a6c4bd6a71f9067ea1aa685690a

    • SHA1

      2986ebc39727d52b72bd5489ef1806c299726055

    • SHA256

      11792ee86d2847e73686ec5530b120ed9cef93393290f147336866626cd5797a

    • SHA512

      60bbdeb286a28c5507cf32e488a25353f3e082cb66523ce83e2aa67935d4b4c5fa4e03b2a1553ead3d2abdb0d7731e18d0194b0348ccce42bf52f154a2a41235

    • SSDEEP

      98304:zDf+qQgWuqOeKQhHJH2ROwfKb9L4A+RY2Z58:zDIgWud/ipWROwf20AEZO

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks