nitro | dc464ff6c0a7512b6c2582f1539176f1eb409e603fecde8a3eb19661eaffe60d | Triage

Sharing

General

Target

1a4d0f0002036b4c77841100a8e05f46_JaffaCakes118
Size

61KB
Sample

241006-3kte5awdrc
MD5

1a4d0f0002036b4c77841100a8e05f46
SHA1

a9733fe6b29bfa2aed64a4fc0d9eef7083252b84
SHA256

dc464ff6c0a7512b6c2582f1539176f1eb409e603fecde8a3eb19661eaffe60d
SHA512

7c2a166c5032b83cce37e007c380805f8f90f8fa0b35958c44b8cad349f61dabd8fe3d8f811a4e6fe33f09887401d4d0965eec4f3eb4237ea1d3af4c2e8d7ea5
SSDEEP

768:BKsMqCXfVcWlQM9ZkiANIULTYLDwUzc80gmq3oP/oDE:BKseSM9ZkiAPgr/0O8/oo

Score

10^/10

nitro discovery persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  1a4d0f0002036b4c77841100a8e05f46_JaffaCakes118
- Size
  
  61KB
- MD5
  
  1a4d0f0002036b4c77841100a8e05f46
- SHA1
  
  a9733fe6b29bfa2aed64a4fc0d9eef7083252b84
- SHA256
  
  dc464ff6c0a7512b6c2582f1539176f1eb409e603fecde8a3eb19661eaffe60d
- SHA512
  
  7c2a166c5032b83cce37e007c380805f8f90f8fa0b35958c44b8cad349f61dabd8fe3d8f811a4e6fe33f09887401d4d0965eec4f3eb4237ea1d3af4c2e8d7ea5
- SSDEEP
  
  768:BKsMqCXfVcWlQM9ZkiANIULTYLDwUzc80gmq3oP/oDE:BKseSM9ZkiAPgr/0O8/oo
Score

10^/10

nitro discovery persistence ransomware spyware stealer
- Nitro
  A ransomware that demands Discord nitro gift codes to decrypt files.
  ransomware nitro
- Renames multiple (85) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

nitrodiscoverypersistenceransomwarespywarestealer

behavioral2

discoverypersistenceransomwarespywarestealer