Overview

overview

10

Static

static

3

NitroRansomware.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NitroRansomware.exe

  • Size

    46KB

  • Sample

    231125-vhaw1abf52

  • MD5

    af57b5cdafd36c63826b26ad16d78e3d

  • SHA1

    19405d20a07fcc4b5a8c0840db657d137e68b076

  • SHA256

    dd7daac7332b1b74aebe5e3374efc2a4efa10a0629e327a3a0aaf777e400a731

  • SHA512

    41ebea4b37b802c8b78c804bad6482e32cb2b78a75a9b6b848ef0899eb238aca89fb4c7fda4a47e862ee045624d0830e662893a233c766886c356464246ea61a

  • SSDEEP

    768:ZRUiBoXdCiIuiAzYEYySfjYwmlLDwUzc8y:ZRU1kZ5AzYAS8nlr/y

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      NitroRansomware.exe

    • Size

      46KB

    • MD5

      af57b5cdafd36c63826b26ad16d78e3d

    • SHA1

      19405d20a07fcc4b5a8c0840db657d137e68b076

    • SHA256

      dd7daac7332b1b74aebe5e3374efc2a4efa10a0629e327a3a0aaf777e400a731

    • SHA512

      41ebea4b37b802c8b78c804bad6482e32cb2b78a75a9b6b848ef0899eb238aca89fb4c7fda4a47e862ee045624d0830e662893a233c766886c356464246ea61a

    • SSDEEP

      768:ZRUiBoXdCiIuiAzYEYySfjYwmlLDwUzc8y:ZRU1kZ5AzYAS8nlr/y

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Renames multiple (63) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks