Overview

overview

10

Static

static

3

4ae1ea60f3...18.exe

windows7-x64

10

4ae1ea60f3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ae1ea60f3ce403f37b317a9ad21f15a_JaffaCakes118

  • Size

    60KB

  • Sample

    241016-b689xswgpd

  • MD5

    4ae1ea60f3ce403f37b317a9ad21f15a

  • SHA1

    3b4fe3a2b10c6c8dff5d66ba63a286a7793ddaa7

  • SHA256

    930942fa07b68fbb7ffa8b3ce7f1121b3d576567176ca242721e4be14fb84f5e

  • SHA512

    0bb09e57988a675472a00189d60a455e36809c2d8f6943f4de76008ca2c88194887bbbe669d63184b716f0508b545900c23a5a78ab13e4da41b5eac645af32e0

  • SSDEEP

    768:JOucKn7n1JSDNANIUdTvLDwUzc80gmq3oP/oDg:JO2SDNAPFr/0O8/o8

Score
10/10
nitrodiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      4ae1ea60f3ce403f37b317a9ad21f15a_JaffaCakes118

    • Size

      60KB

    • MD5

      4ae1ea60f3ce403f37b317a9ad21f15a

    • SHA1

      3b4fe3a2b10c6c8dff5d66ba63a286a7793ddaa7

    • SHA256

      930942fa07b68fbb7ffa8b3ce7f1121b3d576567176ca242721e4be14fb84f5e

    • SHA512

      0bb09e57988a675472a00189d60a455e36809c2d8f6943f4de76008ca2c88194887bbbe669d63184b716f0508b545900c23a5a78ab13e4da41b5eac645af32e0

    • SSDEEP

      768:JOucKn7n1JSDNANIUdTvLDwUzc80gmq3oP/oDg:JO2SDNAPFr/0O8/o8

    Score
    10/10
    nitrodiscoverypersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Renames multiple (112) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks