Overview

overview

10

Static

static

10

2026-04-14...st.exe

windows10-2004-x64

10

2026-04-14...st.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-14_8825b8b0267a800600680cc0f7d03641_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
  • Size 3.1MB
  • Sample260414-d9pqssey5v
  • SHA256 1f75a101441bbe07696e7b69a4a98d6dcd0a418667706d9c1b3ada9a73f3dc24
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
nightspirecredential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\ProgramData\Adobe\[NSPIRE_MSG].txt

  • nightspire

Ransom Note
  • NightSpire Encryption Notice Your internal servers and backup & virtual infrastructure have been fully compromised. All your files encrypted by NIGHTSPIRE Ransomware. Sensitive data are all copied — cooperate to avoid publication. We are prepared to publish everything. You have 72 hours to respond. The initial payment for decryption and file deletion is 10 BTC. This amount is based on your annual revenue. However, the amount can be renegotiated depending on the circumstances. If you respond within 48 hours, you'll only pay 7 BTC, which is a 30% discount. If you pay within 48 hours, you'll only pay 5 BTC, which is a 50% discount. If you pay within 24 hours, you'll only pay 4 BTC, which is a 60% discount. "The sooner you pay, the lower the ransom." That's our policy. The ransom will increase once we begin analyzing the data. After 48 hours, we will begin analyzing the data. Failure to cooperate will result in public disclosure. We possess a complete list of files and document samples that serve as proof of the access. You can see the decryption demo video and the list of copied files on our website. ------------------- About NightSpire – Cooperate: The Win-Win Resolution ------------------- Full Decryption Tool + Instructions: Universal binary decrypts all affected systems in hours. Data Deletion Proof: Timestamped logs, blockchain-verified wipe certificates—your data erased forever. Secrecy Assurances: No traces online; we expunge all references post-deal. Bonus: Security Audit Report: Detailed breach vector analysis + fixes, valued at $50K+ from legit firms. Payment Flexibility: Crypto (BTC We Offer), staged if needed—processed by our financial team. NightSpire isn't a lone hacker in a basement. We're a structured syndicate with standard operating procedures, support desks, recruiters, and analysts—like a Fortune 500 but optimized for cyber efficiency. Our reputation demands we deliver: victims who pay get results, building trust for mutual long-term gains. Non-payment erodes that, but cooperation upholds it. Security researchers and reputation confirm, we're a fully fledged cyber group... built to monetize. We honor deals to ensure repeat business across the ecosystem. --------------------------- WHAT HAPPENS IF YOU DON'T PAY ------------------------------- - The hacked news about your company will be posted on our Onion site. - All your data will be posted free of charge on our Onion site. - Sensitive and confidential files will be made publicly available. - Your clients and partners may be notified about the data breach. - The data may be shared or sold to third parties. - You will permanently lose access to your encrypted data. - We will not provide any decryption tools or support. ----------------------------------------- CAUTION --------------------------------------------- >>> Important – Do Not DO NOT modify files. DO NOT use third-party tools. Unncessary activities cause permanent loss of your data. AES-256/RSA-4096 = impossible without our key. >>> WARNING – NO INTERMEDIARIES Do NOT use recovery or negotiation companies. They are middlemen who profit from deception. For example: They charged victims $1M Secretly negotiated with us for $200K Kept $800K for themselves. Contacting us directly = 5× lower cost. Middlemen only steal from you. Deal direct. Pay less. Resolve faster. >>> IMPORTANT – INSURANCE NOTICE Do NOT involve your cyber insurance company directly. They will sabotage negotiations to avoid paying the full policy amount. If your coverage is $10M, they will offer us $100K. We will reject it. They will refuse to increase. Result: no payment, full data leak, total damage — for you. If you anonymously inform us of your insurance limits and terms, we will NOT exceed that amount in negotiations. This guarantees: • Fast resolution • Data deletion • Full decryption • No public leak Silence only benefits the insurer. Transparency benefits you. Choose wisely. >>> CONSEQUENCES OF DATA LEAK If your data is leaked: • Government fines (GDPR, compliance, tax authorities) • Lawsuits from clients and partners • Criminal abuse of employee and customer identities • Bank fraud, loan fraud, money laundering • FBI investigations and legal exposure • Competitor espionage and business sabotage • Employee poaching and loss of trade secrets • Permanent reputation destruction Your company will bleed money, clients, trust, and stability. Statistics: 2 out of 3 companies shut down within 6 months after a major data breach. The cost of recovery is hundreds of times higher than the ransom. Paying is faster. Cheaper. Safer. Your reputation took years to build. It takes minutes to destroy. Read more about the GDRP legislation:: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr.eu/what-is-gdpr/ https://gdpr-info.eu/ -------------------------------------------- How to Contact Us --------------------------------------------- >>> Using qTox Chat App Our qTox ID: 038F61A270B8094E713E4815C4FA5086E4AD3A021575C6F90EE65A0C123D3E3BF6926C3B59EA Our qTox ID: 8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F >>> Using Tor Browser: 1. Download Tor Browser: https://www.torproject.org/ 2. Install Tor Browser: • Windows: Run the installer, launch Tor Browser, and click Connect. • macOS: Open the downloaded .dmg file, drag Tor Browser to Applications, launch it, and click Connect. • Linux: Extract the downloaded package, run ./start-tor-browser.desktop, and click Connect. • Android: Install from Google Play or torproject.org, open the app, and tap Connect. • iOS (iPhone): Install Onion Browser from the App Store, open it, and tap Connect. 3. Access the under link once connected. http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion Login with UUID "NSPIREAEH8GA1SPVXMVH" and password "c4PtB83UTMHndnqr". 4. Also introduce you to our blog site where you can learn more about us through the link below. http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/ >>> On Mail Proton Mail: [email protected] Onion Mail: [email protected] Contact us and verify with UUID "NSPIREAEH8GA1SPVXMVH". ----------------------------------------------------- FAQ ------------------------------------------------------ Proof? Preview + Free sample decrypts. Safe tool? Universal, tested. Data gone? Solid proof. Future attacks? Pay = gone forever + fixes. Team NightSpire.
URLs

  • https://gdpr.eu/what-is-gdpr/

  • https://gdpr-info.eu/

  • http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion

  • http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/

Targets

    • Target
      2026-04-14_8825b8b0267a800600680cc0f7d03641_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver
    • Size 3.1MB
    • SHA256 1f75a101441bbe07696e7b69a4a98d6dcd0a418667706d9c1b3ada9a73f3dc24
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoverynightspireransomwarespywarestealer

    • Family: NightSpire

      Nightspire is a Windows ransomware written in Golang.

      ransomwarenightspire

    • Renames multiple (944) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks