Overview

overview

10

Static

static

3

227a73d24f...ce.exe

windows7-x64

10

227a73d24f...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    227a73d24f797b6ddc724f54992f05ce

  • Size

    64KB

  • Sample

    231231-bdk2madcb4

  • MD5

    227a73d24f797b6ddc724f54992f05ce

  • SHA1

    05d43fa2e84bfbf14e74256b65f3070fdf640e02

  • SHA256

    13c62078b17609a57ecdf9c64e3f16fcfdac866ca58c7929326a260ccdef76b6

  • SHA512

    98916906eab6e5ed98f494c2a522c254992f7849b7324bd176e44812118dd9fd2c1c86e59930b7f645410aa72827041ff6adb3988762a78349ae8dc3dfee770c

  • SSDEEP

    768:UiXcvIVLDwUzc8Ugmq3oP/oDzayoiT8WldZtUn3Ahui:UQr/UO8/oCTmVl1U8ui

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      227a73d24f797b6ddc724f54992f05ce

    • Size

      64KB

    • MD5

      227a73d24f797b6ddc724f54992f05ce

    • SHA1

      05d43fa2e84bfbf14e74256b65f3070fdf640e02

    • SHA256

      13c62078b17609a57ecdf9c64e3f16fcfdac866ca58c7929326a260ccdef76b6

    • SHA512

      98916906eab6e5ed98f494c2a522c254992f7849b7324bd176e44812118dd9fd2c1c86e59930b7f645410aa72827041ff6adb3988762a78349ae8dc3dfee770c

    • SSDEEP

      768:UiXcvIVLDwUzc8Ugmq3oP/oDzayoiT8WldZtUn3Ahui:UQr/UO8/oCTmVl1U8ui

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Renames multiple (85) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks