Overview

overview

10

Static

static

10

Nitro by G...or.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nitro by NC.zip

  • Size

    16.8MB

  • Sample

    231228-amds8sdfcj

  • MD5

    8279396894636782c8f42ffbba6ae273

  • SHA1

    cc85d2247f90b31ea88c4abeb9e35f9b77281fba

  • SHA256

    e3fc332254dd9335e74ef9911b681554a3080cc7b810a69b6a934d83620848ef

  • SHA512

    d920416b875b4fb9ac0c80cc7d3db9da88feeb18764eff589048c4d8f35968fdb35236ac627571e20af67eee392cb5ac60571465f0873807e07139d796831480

  • SSDEEP

    393216:17hp7oi2enPFD7pLztUQmaXFlRIT21oG2BuZWJspoHD2Y:Ppsi2enp7pLBJmaXjG61oBBQwKoHqY

Score
10/10
crealstealerpersistencepyinstallerspywarestealer

Malware Config

Targets

    • Target

      Nitro by Gabriel/Nitro Generator.exe

    • Size

      17.1MB

    • MD5

      bb64387766b55fe98c73767ad9076686

    • SHA1

      e053872b961382c95e5c58d035b50b52d34803b1

    • SHA256

      a5cd667a686d3140aef60b4d11679491751a24adace845c04a65f9db84483488

    • SHA512

      e77cdf900a430616aa99eea4fa56737c7dade78381de68e17471e14b366fb8f1faee867ef1ebc22e753b70fa166e592e9281e8e47c5be63184ae61db8b90707c

    • SSDEEP

      393216:3u7L/sQbo3pUTLfhJjdQuslSl99oWOv+9fPjMb6Y5/n:3CL0QbaUTLJRdQu9DorvSHjy6Yp

    Score
    8/10
    persistencespywarestealer

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks