General
-
Target
Nitrogen.zip
-
Size
450KB
-
Sample
250404-a7eahazkw2
-
MD5
280b1bfe4e51f4bd2dd327b683497532
-
SHA1
518ebf1b067ff5184a8049c8219cf0957850c01e
-
SHA256
e038854494c067f921f7df47f3149c782779a26d23581d8c3c87d4c5e2270847
-
SHA512
2eced74052d7a884043c76b6256ce6abade4d27fd9e69c19c3f5dd967d16c63928c19c89093ab44f1d10a4c458c9643238e95c01fb8955aceae0f7b75042423b
-
SSDEEP
12288:gcx2q74v6drMyCDtKnysl/4cZwptJStZ84rFrjy0I+SI:FAq7korM3t8xd4cUJSt2+9xDSI
Static task
static1
Behavioral task
behavioral1
Sample
Nitrogen.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\Recovery\readme.txt
http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion
http://xqsdbtrtmufdyiqnkrkvosec4gqappf2egcptzqppjtqdevsoadakyqd.onion/quick-access/5RyUpUB1erpS21m9la/chats/veaftorztqes
Targets
-
-
Target
Nitrogen.exe
-
Size
1.2MB
-
MD5
834d94cf35d9417aa93a5cb350a756e9
-
SHA1
5fbe4fef61314da6663b17b9120af20db0a2866f
-
SHA256
0db5c55ef52e89401a668f59bf4f69391f4632447c51483bb64749d7f2123916
-
SHA512
d986d4af87088a1599fd2c5eb8bc19594509bd422c1f462788430f6b636c75b9e578889c7322b841d2f0cd77c789c243dc979608f213f9b255a439f11ac70728
-
SSDEEP
24576:Ye5MhKjQ6Vrn/hdGNGVb9e5DFzvwPxoAgCxp59p:YeEl6Vrn/HQGVb9e5DFzvExVgC
-
Renames multiple (1369) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Drops desktop.ini file(s)
-