Overview

overview

10

Static

static

3

682723a522...a1.exe

windows7-x64

10

682723a522...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    682723a522c86f64b397afcdd65c21a1

  • Size

    61KB

  • Sample

    240119-vfcb2sagb3

  • MD5

    682723a522c86f64b397afcdd65c21a1

  • SHA1

    80999ff4ac0b068eb5028b50601b7ec9fe77a827

  • SHA256

    fb92c528c1207a2421ec817cbf9793a3859637d7dc235a3998e07695860e3ce1

  • SHA512

    703aafcece75f310b42c52aa42ddfbf3a680b6e2636c08f5ca1895abc722fe7fce99484b6257bbe70d5253f6a054c74c8b2fb6abcb431702e901efd51e7355c3

  • SSDEEP

    768:VHKsMqCXfVcWlQM9ZkiANIULAYLDwUzc80gmq3oP/oDw:hKseSM9ZkiAP1r/0O8/os

Score
10/10
nitropersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      682723a522c86f64b397afcdd65c21a1

    • Size

      61KB

    • MD5

      682723a522c86f64b397afcdd65c21a1

    • SHA1

      80999ff4ac0b068eb5028b50601b7ec9fe77a827

    • SHA256

      fb92c528c1207a2421ec817cbf9793a3859637d7dc235a3998e07695860e3ce1

    • SHA512

      703aafcece75f310b42c52aa42ddfbf3a680b6e2636c08f5ca1895abc722fe7fce99484b6257bbe70d5253f6a054c74c8b2fb6abcb431702e901efd51e7355c3

    • SSDEEP

      768:VHKsMqCXfVcWlQM9ZkiANIULAYLDwUzc80gmq3oP/oDw:hKseSM9ZkiAP1r/0O8/os

    Score
    10/10
    nitropersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Renames multiple (71) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks