General
- Target Nitro Generator.exe
- Size 80.9MB
- Sample240525-p9eflsdf58
- SHA256 ee08898040836a55a1b02c2181aa40d2e4d91ff1d707cacab1a590415dbb39c1
Score
10/10
Malware Config
Targets
-
- Target Nitro Generator.exe
- Size 80.9MB
- SHA256 ee08898040836a55a1b02c2181aa40d2e4d91ff1d707cacab1a590415dbb39c1
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
- Target discord_token_grabber.pyc
- Size 17KB
- SHA256 4a3ecb93ca81bc8754a8fc926270f649ae7d00e9a2ef092abf00c86a0c4634f0
Score3/10 -
- Target get_cookies.pyc
- Size 10KB
- SHA256 a68afbac4d16fa89db22d81f6010f520868fafd50c1b2c8d868a662d210301ff
Score3/10 -
- Target misc.pyc
- Size 5KB
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
Score3/10 -
- Target passwords_grabber.pyc
- Size 8KB
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
Score3/10 -
- Target source_prepared.pyc
- Size 185KB
- SHA256 7dc801219845fa8cc781024678b3f498160173a5bc6c71ed43d3639d404cd6f3
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1