Overview

overview

10

Static

static

10

32e10dc9fe...a5.exe

windows10-2004-x64

10

32e10dc9fe...a5.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5
  • Size 4.2MB
  • Sample250807-sbkfrattat
  • SHA256 32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nightspirecredential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\14659f88344aa0197a73d923be\readme.txt

  • nightspire

Ransom Note
  • Hi, Your hotel is hacked! Your servers and files are locked and copied. =================================== REMEMBER! We also locked files in OneDrive. And we did not change the extensions of files in OneDrive. =================================== You cannot decrypt yourself without our key, even you're using third party software or from help of security companies. Please do not waste your time. Your files will be easily decrypted with pay. Never worry. We're waiting here with UUID nkobsv9jxmwvt26ad335g56e3ipt37etvfrt6chp Method * : [email protected] Method 1 : Our qTox ID 3B61CFD6E12D789A439816E1DE08CFDA58D76EB0B26585AA34CDA617C41D5943CDD15DB0B7E6 Method 2 : Browse our Onion Site with Tor Browser http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion We're waiting here with UUID nkobsv9jxmwvt26ad335g56e3ipt37etvfrt6chp
URLs

  • http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion

  • http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion

Targets

    • Target
      32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5
    • Size 4.2MB
    • SHA256 32e10dc9fe935d7c835530be214142041b6aa25ee32c62648dea124401137ea5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    nightspirecredential_accessdiscoveryransomwarespywarestealer

    • NightSpire

      Nightspire is a Windows ransomware written in Golang.

      ransomwarenightspire

    • Nightspire family

      nightspire

    • Renames multiple (924) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks