Overview

overview

10

Static

static

10

Nitro Generator.exe

windows7-x64

7

Nitro Generator.exe

windows10-2004-x64

9

discord_to...er.pyc

windows7-x64

3

discord_to...er.pyc

windows10-2004-x64

3

get_cookies.pyc

windows7-x64

3

get_cookies.pyc

windows10-2004-x64

3

misc.pyc

windows7-x64

3

misc.pyc

windows10-2004-x64

3

passwords_grabber.pyc

windows7-x64

3

passwords_grabber.pyc

windows10-2004-x64

3

source_prepared.pyc

windows7-x64

3

source_prepared.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nitro Generator.exe

  • Size

    80.9MB

  • Sample

    240525-p9eflsdf58

  • MD5

    4ae3ac1f451b581d5cd246a1cf195e94

  • SHA1

    6dfd926a86fd96f48bdb4036825e3bccefea8f80

  • SHA256

    ee08898040836a55a1b02c2181aa40d2e4d91ff1d707cacab1a590415dbb39c1

  • SHA512

    6d96d09cd12037be3e9abc5d0a8aa571b10952fa59561a8364c6fe06aa589be1ac7715895e8a05d52a539743275065d9a89df0ef275e72941a072f9e77f5881c

  • SSDEEP

    1572864:jvNBYQ3jZ23Sk8IpG7V+VPhq+EE70jC9iYgj+h58sMwoWd9v6P3qDhhX:jvNBY+4SkB05aw+OuH58G9v6y

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      Nitro Generator.exe

    • Size

      80.9MB

    • MD5

      4ae3ac1f451b581d5cd246a1cf195e94

    • SHA1

      6dfd926a86fd96f48bdb4036825e3bccefea8f80

    • SHA256

      ee08898040836a55a1b02c2181aa40d2e4d91ff1d707cacab1a590415dbb39c1

    • SHA512

      6d96d09cd12037be3e9abc5d0a8aa571b10952fa59561a8364c6fe06aa589be1ac7715895e8a05d52a539743275065d9a89df0ef275e72941a072f9e77f5881c

    • SSDEEP

      1572864:jvNBYQ3jZ23Sk8IpG7V+VPhq+EE70jC9iYgj+h58sMwoWd9v6P3qDhhX:jvNBY+4SkB05aw+OuH58G9v6y

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      discord_token_grabber.pyc

    • Size

      17KB

    • MD5

      b1549a826942ffd6e5850abe54fbc5ee

    • SHA1

      32df6837bccaf45278782c9e6924455dc4166363

    • SHA256

      4a3ecb93ca81bc8754a8fc926270f649ae7d00e9a2ef092abf00c86a0c4634f0

    • SHA512

      253bbf7b789de7196f330644ffbc53f6126d5113f045a3766139de7ed9c27cba4321b550a4450a59a80bc56f187dfe4749a9906f5f0494308943ded06016b18b

    • SSDEEP

      384:cGllyAavQS9F0RW807PPQviowoYbCD+Mo8WWIc02a8:cIlytv39iRW8inQ6owoYOSM0d2a8

    Score
    3/10
    behavioral3behavioral4

    • Target

      get_cookies.pyc

    • Size

      10KB

    • MD5

      d157cf31f7829c5c9c88e656409840c6

    • SHA1

      1d53ed755119f80284b52f2e17198e2943452b92

    • SHA256

      a68afbac4d16fa89db22d81f6010f520868fafd50c1b2c8d868a662d210301ff

    • SHA512

      ccbdfc5c9db196f0a10195c6f52e6fccf073020a6715f2407da23800b12ef9bb6d7e7ffe08cbe448bea7fb7b5ef8772c931e2e129d3ec73151dafcbf7c610793

    • SSDEEP

      192:TzOCIeinQfUF9LdwOEVOFc1mNe4qo+zEzzzzz1zz+HoowAE:TzOUiQccEe4qoOIAE

    Score
    3/10
    behavioral5behavioral6

    • Target

      misc.pyc

    • Size

      5KB

    • MD5

      31aa260c6cdeaa9d942cd0dcfcadd16a

    • SHA1

      a6818f3acf5c2ab9d65b41a81cb92b36b85cc932

    • SHA256

      b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c

    • SHA512

      0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c

    • SSDEEP

      96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ

    Score
    3/10
    behavioral7behavioral8

    • Target

      passwords_grabber.pyc

    • Size

      8KB

    • MD5

      704dced7f7530b19a34a5f7a71c26b10

    • SHA1

      608d9647488cfa2b5f84a891028168a973bfcfa9

    • SHA256

      1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac

    • SHA512

      e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f

    • SSDEEP

      192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn

    Score
    3/10
    behavioral10behavioral9

    • Target

      source_prepared.pyc

    • Size

      185KB

    • MD5

      8d3447b12ca3a09e90986041cadc0090

    • SHA1

      8be8a6f3c98ae15eb8bfec07a08d1d267a43999a

    • SHA256

      7dc801219845fa8cc781024678b3f498160173a5bc6c71ed43d3639d404cd6f3

    • SHA512

      f4c1fd4e3cc7f3e6c03d1d19045f1440ccd6133fee2c3d4845c7565f56c97d23438a415e374158c975a58dcd3fd84fad38078a091525532ebb056a5d897e13c5

    • SSDEEP

      3072:wTV6La+/4A9M/2CYolPEtelZN+tVZaftogjHBuCkn0:wTcW+/ZuYol8cN+7ZaftogjH8Ch

    Score
    3/10
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks