nightingale | 3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358

Analysis

Target

3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Size

144KB
MD5

319218e4eb0d6637a76668a228e32de3
SHA1

20523303d722a7747deb6154a5d4401e1b932d56
SHA256

3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358
SHA512

db3d1637c178bdf3c8c5b754fe72c388a3da176b2d0a7727e89f2c257bcb93b1574eda1de7f6ea25e493949f47157c07637fbe1169fe6c9481cc42d925293fe6
SSDEEP

3072:HGNhvhNC38S7gzQ/cmD4ULz82nyLOLt/w/HOWJbG5vcX+skwEKEAm31D5:EzQ/2my2w/uWJbGFsREKQ1

Score

10^/10

Family

nightingale

185.196.8.223:3999

https://api.telegram.org/bot6813766312:AAGyxmK0E-SiPNsQCpjEIFZJIOhZnrPLxhw/sendMessage?chat_id=6467170572

Nightingale family
nightingale
Nightingale stealer
Nightingale stealer is an information stealer written in C#.
stealer nightingale

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open\command\	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open\command	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe

C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
"C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe"
1⤵
- Modifies registry class
PID:1612

memory/1612-0-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1612-2-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download
memory/1612-3-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-4-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download