General
- Target 2026420laclinicenc.exe
- Size 3.1MB
- Sample260512-2s5yfsev7k
- SHA256 69f5515ff3f554233840ad2f2397b345f955013017a9ae14ed4e762f52d936af
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\Adobe\[NSPIRE_MSG].txt
-
nightspire
Ransom Note
- ~~~ You have been attacked by NightSpire.Team ~~~ All data was encrypted.(There might be some files which extensions are remaining as original, but they are all encrypted as well.) We have taken your sensitive data. If you want check the list of files we have stolen, you can find it on our WEBSITE CHAT (http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion). ******************************************************************* We want Only $500K in BTC. + If you contact us within 24 hours, you will receive a 30% discount on the price. + If you pay us within 48 hours, you will receive a 40% discount on the price. + And also if you pay us within 24 hours, you will receive a 50% discount on the price. * We can adjust the LARGER DISCOUNT if you engage in ACTIVE NEGOTIATION. * After 24 hours, we will public your company's real name and conduct a full-scale investigation into your data. * In 72 hours, we will begin the leak, starting with the oldest data. ****************************************************************** ***If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Provides DECRYTPION TOOL & KEY and permanently DELETE the stolen data. And also we’ll help reinforce your internal network with strong security measures to make sure you never face another ransomware attack. You can recover your system and files within only 5 hours with our help*** >>>>>What happens if you don't pay? 1. We will provide your all data to CLIENTS, GOVERNMENT and LEGAL authorities. 2. We will transfer information to your competitors. 3. We will make all the information public on our website.(http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/) 4. We will do our utmost to ensure your Company's faces significant fines and reputational damage. >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! ****************************************************************** >>>>>Contact us. >>> Using Our WEBSITE CHAT(You can only connect our site with Tor Browser) + Download and install Tor Browser at https://www.torproject.org/ + Through Tor Browser, enter below url http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion + Enter UUID "NSPIRE830NPH7ZLBRW39" and PASSWORD "769FZisalII12Rph" on Login Page >>> Using qTox Chat App qTox ID1: 038F61A270B8094E713E4815C4FA5086E4AD3A021575C6F90EE65A0C123D3E3BF6926C3B59EA qTox ID2: 8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F >>>Using e-Mail: [email protected] [email protected] ****************************************************************** DO NOT SHARE UUID TO ANYONE!!!
URLs
-
http://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion
Targets
-
- Target 2026420laclinicenc.exe
- Size 3.1MB
- SHA256 69f5515ff3f554233840ad2f2397b345f955013017a9ae14ed4e762f52d936af
Score10/10Family: NightSpire
Nightspire is a Windows ransomware written in Golang.
Renames multiple (993) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)