Resubmissions

02-10-2023 11:43

231002-nvrlyshf6t 10

23-05-2023 19:13

230523-xw29hsgh32 7

General

  • Target

    DiscordNitroGen.exe

  • Size

    5.0MB

  • Sample

    231002-nvrlyshf6t

  • MD5

    ac03bc15840de0735bc509df2605315d

  • SHA1

    c83e86956dfe720289e05b765b16d6c4bed1b380

  • SHA256

    5f7ef589be80bc41e17b2bc2bb9dcfb9f457815298228b313b4186d983a9b206

  • SHA512

    8221ddc84711e6fd3f8a6b25178b7222fa60aded1b2f82c0da307bd4160ddbab90f41b85deba7a772df380837c129bb45a059f2aca7ce335094001f68471aef0

  • SSDEEP

    3072:tk9F8AiUC7llUdOKViKa6pOWbhpAKyKIVUjtub/cOZzo0xBe0DE:tk9ovTKDhpAKwmEbFZUWD

Malware Config

Extracted

Family

growtopia

Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/741651301993152592/741658256740712458/WebBrowserPassView.exe

Targets

    • Target

      DiscordNitroGen.exe

    • Size

      5.0MB

    • MD5

      ac03bc15840de0735bc509df2605315d

    • SHA1

      c83e86956dfe720289e05b765b16d6c4bed1b380

    • SHA256

      5f7ef589be80bc41e17b2bc2bb9dcfb9f457815298228b313b4186d983a9b206

    • SHA512

      8221ddc84711e6fd3f8a6b25178b7222fa60aded1b2f82c0da307bd4160ddbab90f41b85deba7a772df380837c129bb45a059f2aca7ce335094001f68471aef0

    • SSDEEP

      3072:tk9F8AiUC7llUdOKViKa6pOWbhpAKyKIVUjtub/cOZzo0xBe0DE:tk9ovTKDhpAKwmEbFZUWD

    • Growtopia

      Growtopa is an opensource modular stealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks