General
-
Target
8bf1c633b4e20c6896a3fd307a840245_JaffaCakes118
-
Size
61KB
-
Sample
241103-rt8evsyqbk
-
MD5
8bf1c633b4e20c6896a3fd307a840245
-
SHA1
20e579b22ca06c0509fbc194888bad168d5adb0f
-
SHA256
fb9babb3bd29a77738bb4e4f37394992be0add9521ef64adece1845ea479313c
-
SHA512
209880229d0fdeb738a74c9f6f38711b6b9806f0456248940df0fe197063fc6f8029c9fbf1e6b0c9a08526c732fd504deda930c800fc691d2995515644185d63
-
SSDEEP
768:YP+2AG1MXq9E3tnJvLDwUzc80gmq3oP/oDS:Vz819EJhr/0O8/o+
Malware Config
Targets
-
-
Target
8bf1c633b4e20c6896a3fd307a840245_JaffaCakes118
-
Size
61KB
-
MD5
8bf1c633b4e20c6896a3fd307a840245
-
SHA1
20e579b22ca06c0509fbc194888bad168d5adb0f
-
SHA256
fb9babb3bd29a77738bb4e4f37394992be0add9521ef64adece1845ea479313c
-
SHA512
209880229d0fdeb738a74c9f6f38711b6b9806f0456248940df0fe197063fc6f8029c9fbf1e6b0c9a08526c732fd504deda930c800fc691d2995515644185d63
-
SSDEEP
768:YP+2AG1MXq9E3tnJvLDwUzc80gmq3oP/oDS:Vz819EJhr/0O8/o+
Score10/10-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Nitro family
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-