nightingale | 81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7

Analysis

Target

Xujamon_LetThereBeNightingale.exe
Size

144KB
MD5

9260f5e80678b6490676270838c08941
SHA1

2a01024380703d67bc59b47c109f255e59a1554b
SHA256

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7
SHA512

53b2999b1e3aec6cc6b58f7f3845f180060cea68f055a0632f325a3c28e7232a9362ea112ade2ca1a178e621187bf3200d9e5b531361f7f1f938f28a6fd4f32c
SSDEEP

3072:nywhuhNC38S7gzQ/cGD4UdYs2sbyYtLt/w/HOWJbG5vcX+1kwEKEAm31D1:+zQ/FnbyIw/uWJbGF1REKQ1

Score

10^/10

Family

nightingale

80.76.49.148:3999

Nightingale family
nightingale
Nightingale stealer
Nightingale stealer is an information stealer written in C#.
stealer nightingale

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open\command\	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open\command	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open	Xujamon_LetThereBeNightingale.exe

C:\Users\Admin\AppData\Local\Temp\Xujamon_LetThereBeNightingale.exe
"C:\Users\Admin\AppData\Local\Temp\Xujamon_LetThereBeNightingale.exe"
1⤵
- Modifies registry class
PID:3296

memory/3296-0-0x00007FFB523E3000-0x00007FFB523E5000-memory.dmp

Filesize
8KB

Download
memory/3296-1-0x0000028329E30000-0x0000028329E5A000-memory.dmp

Filesize
168KB

Download
memory/3296-2-0x00007FFB523E0000-0x00007FFB52EA1000-memory.dmp

Filesize
10.8MB

Download
memory/3296-3-0x00007FFB523E0000-0x00007FFB52EA1000-memory.dmp

Filesize
10.8MB

Download