Overview

overview

10

Static

static

3

nitrogenerator!.exe

windows10-1703-x64

7

nitrogenerator!.exe

windows10-2004-x64

10

nitrogenerator!.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nitro generator!.zip

  • Size

    10.2MB

  • Sample

    240722-jxm94axdlr

  • MD5

    6700bd5d9fcecbb087e98199ccf44e1b

  • SHA1

    3cc480163565222380fff73eccc219add8510728

  • SHA256

    80c1704fc0738063222fd41ae186dc8afb918c4669a965b65a6d3c11f52257bd

  • SHA512

    39c087ec8d74ce1dd5713639e33e55a3aa5380efaa1a09534d56a1a6e65d587eb813eb69afd0a3751ef2f7cd66d6d5ca83877282b6b2a21904e5c0bcc85b8f09

  • SSDEEP

    196608:z4MD3rch1HR5ESM6q76461c1Qu6WCTJbG2VJ9PVDiwURrLdXJQ+pDpJR3azyCuyV:n0vFMdn1N6SEPVWPLplJRqX9V

Score
10/10
exelastealerdefense_evasionevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      nitrogenerator!.exe

    • Size

      20.3MB

    • MD5

      3fba0c94287e0daef803f4ab349fdc0a

    • SHA1

      c1e9e2e073e45064d7ad9fab2d53fa7265b745cb

    • SHA256

      d0514ca5d198d6510f7ddfa2f4421ec53b69d59bdbab41932aec6c0312dfd15f

    • SHA512

      0aa72a7ddc182a9a60a735cd5220582281c61444b9add461f41bb71dcafeeaf278c4054e7bc6bcd9f108e6f84a97fff71e7513a3248e00d0d098cf42b3148b55

    • SSDEEP

      196608:H5lPA+Jb3tQk5tOeNvX+wfm/pf+xfdkRGZWKsnwrIWOzW0DaqkH:ZC+7v5tRvX+9/pWFGRsBsnwrIWeRaDH

    Score
    10/10
    upxexelastealerdefense_evasionevasionpersistenceprivilege_escalationpyinstallerspywarestealer

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Process Discovery

1
T1057

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks