Overview

overview

10

Static

static

10

4e58629158...69.exe

windows10-2004-x64

10

4e58629158...69.exe

windows11-21h2-x64

10

Resubmissions

10/10/2025, 03:46

251010-ebn72ser2z10

06/07/2024, 07:41

240706-jjfcbstcph10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4e58629158a6c46ad420f729330030f5e0b0ef374e9bb24cd203c89ec3262669.exe
  • Size 1.4MB
  • Sample251010-ebn72ser2z
  • SHA256 4e58629158a6c46ad420f729330030f5e0b0ef374e9bb24cd203c89ec3262669
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
coffloadernitrogencredential_accessdefense_evasiondiscoveryloaderransomwarespywarestealer

Malware Config

Targets

    • Target
      4e58629158a6c46ad420f729330030f5e0b0ef374e9bb24cd203c89ec3262669.exe
    • Size 1.4MB
    • SHA256 4e58629158a6c46ad420f729330030f5e0b0ef374e9bb24cd203c89ec3262669
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdefense_evasiondiscoverycoffloadernitrogenloaderransomwarespywarestealer

    • Coffloader

      Coffloader is an open-source beacon loader written in C.

      loadercoffloader

    • Coffloader family

      coffloader

    • Detects Coffloader

    • Nitrogen

      Nitrogen is a ransomware that resembles LukaLocke ransomware.

      ransomwarenitrogen

    • Nitrogen family

      nitrogen

    • Renames multiple (9152) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks