General
-
Target
DiscordNitroGenerator.exe
-
Size
118KB
-
Sample
250605-mrwwtswmz6
-
MD5
79a27511481a3ff98353cc18247555d0
-
SHA1
97ad6646d0ac8899a76e02820d57efccfc101da8
-
SHA256
51f67144ecd073fa1ebdcee8005a8c8d0f4281645866c13aef5e4e60591f9a2b
-
SHA512
b334158dcb5b7a3d21d5805088e6a13afdc64041d0d3dc5ce04e71a00ede1238f293109f9f9c6d64a59a53ee5263a2c0880fb26bba84e4fd7ad1da5b75d24eef
-
SSDEEP
3072:NoBng4r9sTE6T2DtXRTBQeqbJWREG8HuRAnNRZR:Chr9sTE6GS2EV1nF
Behavioral task
behavioral1
Sample
DiscordNitroGenerator.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
DiscordNitroGenerator.exe
Resource
win11-20250502-en
Malware Config
Extracted
C:\Users\Admin\Documents\read_me!.txt
33guPaiB1te5KSXMoAFxcCAeroGwrCKzo5
https://www.coinmama.com
https://www.abra.com/buy/bitcoin
Targets
-
-
Target
DiscordNitroGenerator.exe
-
Size
118KB
-
MD5
79a27511481a3ff98353cc18247555d0
-
SHA1
97ad6646d0ac8899a76e02820d57efccfc101da8
-
SHA256
51f67144ecd073fa1ebdcee8005a8c8d0f4281645866c13aef5e4e60591f9a2b
-
SHA512
b334158dcb5b7a3d21d5805088e6a13afdc64041d0d3dc5ce04e71a00ede1238f293109f9f9c6d64a59a53ee5263a2c0880fb26bba84e4fd7ad1da5b75d24eef
-
SSDEEP
3072:NoBng4r9sTE6T2DtXRTBQeqbJWREG8HuRAnNRZR:Chr9sTE6GS2EV1nF
-
Chaos Ransomware
-
Chaos family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1