Overview

overview

10

Static

static

3

NitroRansomware.exe

windows10-ltsc 2021-x64

10

NitroRansomware.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NitroRansomware.exe

  • Size

    58KB

  • Sample

    241123-qjb38svqby

  • MD5

    4d621109413f23798cc7b2b098151b17

  • SHA1

    6090001cdcf47241aff7ba489061a3bf89e201a3

  • SHA256

    98a15cd4586044b67b8a3e91b968f5e1cf1e34695b3691ae853d8f9bb3dc6509

  • SHA512

    d4e1d0bb9c9716dffde27cd3d4741f8371a1aa761e848050774efcb7585b55831e9a95ff6d267b23972bfa018079ad6697fd113785a4ddd5814460efd6019116

  • SSDEEP

    768:dCxeKvsG7+U52ECg5tcXbt23K4xIGEBLDwUzc80gmq3oP/oDuE:dphyK4ur/0O8/o6E

Score
10/10
nitrodiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      NitroRansomware.exe

    • Size

      58KB

    • MD5

      4d621109413f23798cc7b2b098151b17

    • SHA1

      6090001cdcf47241aff7ba489061a3bf89e201a3

    • SHA256

      98a15cd4586044b67b8a3e91b968f5e1cf1e34695b3691ae853d8f9bb3dc6509

    • SHA512

      d4e1d0bb9c9716dffde27cd3d4741f8371a1aa761e848050774efcb7585b55831e9a95ff6d267b23972bfa018079ad6697fd113785a4ddd5814460efd6019116

    • SSDEEP

      768:dCxeKvsG7+U52ECg5tcXbt23K4xIGEBLDwUzc80gmq3oP/oDuE:dphyK4ur/0O8/o6E

    Score
    10/10
    nitrodiscoverypersistenceransomwarespywarestealer

    • Nitro

      A ransomware that demands Discord nitro gift codes to decrypt files.

      ransomwarenitro

    • Nitro family

      nitro

    • Renames multiple (86) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks