General
-
Target
nigger.exe
-
Size
6.8MB
-
Sample
241224-cvwp5ayqgy
-
MD5
5fdcf4f18f5f60842beb0e6b6a7ca838
-
SHA1
9aae3c14069e0136fe6793f83d471272c0cde0ad
-
SHA256
ff7fafddc1870fbcee419e7d1992606cc8006677187125b6cc57c9dc01f02a69
-
SHA512
24c7a836ede996a538d484864bb6f5046a0c57a4f6976be7e46efcf39fcdf19aea0ce6cc3f3631e6b05d0dbb1cc1b99908a567ee01a84d2dd4515c7dbacf2096
-
SSDEEP
98304:cdFkwN+MdA5wqSnWiP8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hB9:cXV1vmB6ylnlPzf+JiJCsmFMvln6hqgT
Behavioral task
behavioral1
Sample
nigger.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
nigger.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
nigger.exe
-
Size
6.8MB
-
MD5
5fdcf4f18f5f60842beb0e6b6a7ca838
-
SHA1
9aae3c14069e0136fe6793f83d471272c0cde0ad
-
SHA256
ff7fafddc1870fbcee419e7d1992606cc8006677187125b6cc57c9dc01f02a69
-
SHA512
24c7a836ede996a538d484864bb6f5046a0c57a4f6976be7e46efcf39fcdf19aea0ce6cc3f3631e6b05d0dbb1cc1b99908a567ee01a84d2dd4515c7dbacf2096
-
SSDEEP
98304:cdFkwN+MdA5wqSnWiP8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hB9:cXV1vmB6ylnlPzf+JiJCsmFMvln6hqgT
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3