Overview

overview

10

Static

static

3

18ac121002...d0.exe

windows7-x64

10

18ac121002...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18ac1210022a7d39b06bc6a6f7673bd0

  • Size

    594KB

  • Sample

    231221-2m7j4aegbr

  • MD5

    18ac1210022a7d39b06bc6a6f7673bd0

  • SHA1

    66b1c674fa8b9812803551c64eb9b6e4d1982be9

  • SHA256

    a8ff938761b156a7564cf7456e0b7e539e91407c6fc30fbd7f6574d93e2bae71

  • SHA512

    e414046979f84fb5193dcc021165cc108084f981b47f2882193d57630b8b0d11a78dc200cd389825e6fdd0e070475a21651ac5627c83cd1ce675da1ef4ee76c6

  • SSDEEP

    12288:EyghPS2IxugLzExJlzjKLt0shRimtXyR1fegnSdYCh6ifn:RCPTeugLIRccmMfaVTf

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      18ac1210022a7d39b06bc6a6f7673bd0

    • Size

      594KB

    • MD5

      18ac1210022a7d39b06bc6a6f7673bd0

    • SHA1

      66b1c674fa8b9812803551c64eb9b6e4d1982be9

    • SHA256

      a8ff938761b156a7564cf7456e0b7e539e91407c6fc30fbd7f6574d93e2bae71

    • SHA512

      e414046979f84fb5193dcc021165cc108084f981b47f2882193d57630b8b0d11a78dc200cd389825e6fdd0e070475a21651ac5627c83cd1ce675da1ef4ee76c6

    • SSDEEP

      12288:EyghPS2IxugLzExJlzjKLt0shRimtXyR1fegnSdYCh6ifn:RCPTeugLIRccmMfaVTf

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Renames multiple (72) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks