5a99be446e5ce23a4c46d7bc0f23fe2e31e1a51027179efa433798cbc6b43e16

Sharing

Copy URL Twitter E-mail

General

Target
NitroAI-Setup-Windows.exe
Size 115.1MB
Sample260828-cgzjvsseme
SHA256 5a99be446e5ce23a4c46d7bc0f23fe2e31e1a51027179efa433798cbc6b43e16
MD5 e71c92fe104d61d505fd610e91b7923f
SHA1 b14337da0cce9fc9338f652837cdd5cf6f218acc
SHA512 7ecb1696f6f61f2de23feabfc4f277de2ce8914d23056746b4a6a5172688e26044f5df8766944988c8959ef604b688592c6e4050eb47d5ee5c299aeb38737043
SSDEEP 3145728:4uLLZLMalGe829slS+OExImW1Mp9BuDZUI9QVgg:h7la29sEmIL1CKDeOg
TLSH
T1A34833A005FA50C7F241A27A74136FB3E567B7C8C39F0A5B570AB9CD92B0D09A753872
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  NitroAI-Setup-Windows.exe
- Size 115.1MB
- SHA256 5a99be446e5ce23a4c46d7bc0f23fe2e31e1a51027179efa433798cbc6b43e16
- MD5 e71c92fe104d61d505fd610e91b7923f
- SHA1 b14337da0cce9fc9338f652837cdd5cf6f218acc
- SHA512 7ecb1696f6f61f2de23feabfc4f277de2ce8914d23056746b4a6a5172688e26044f5df8766944988c8959ef604b688592c6e4050eb47d5ee5c299aeb38737043
- SSDEEP 3145728:4uLLZLMalGe829slS+OExImW1Mp9BuDZUI9QVgg:h7la29sEmIL1CKDeOg
- TLSH
  T1A34833A005FA50C7F241A27A74136FB3E567B7C8C39F0A5B570AB9CD92B0D09A753872
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 114.5MB
- SHA256 b868c9af76492e8b7604c8c5ec4b72a536bb68fa06605ac07b61fa2b4c4a6206
- MD5 31f189f38b6f11c9380b090840d8dedf
- SHA1 4b64f7c791f796e7267b202b7e6b1d4ef53706a9
- SHA512 86472462e8e0e3a68bfdd05ef96af2ff56940c612807e01f9feecf3e906222891f41ebdb25e26e92d98d1bf71d42b68e9ddca1469c554ea8f514d36736252bf2
- SSDEEP 3145728:6LLZLMalGe829slS+OExImW1Mp9BuDZUI9QVgo:U7la29sEmIL1CKDeOo
- TLSH
  T1FE4833A005BB50C7A341A27A74176EB2E563B7CCC3DF0A5B570AF9CD92B0D09A753872
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 599KB
- SHA256 bcd699e5adc1fa4a665baeed6540f50f88b2dad9180b35d613e77e681faa5bff
- MD5 1575c31d2afcff2a0e8ae2be1a54e943
- SHA1 5cda1430114e159ea68c88e8232d2f77c2e4b6e2
- SHA512 7effdf656ccaea958b6b92f1d5aacd566adb4c5a1df27e71ae95faf65683188750752d8e83f649bd310596bdb2ee037b590ee931ca5ec9b3eb0c38dc4a2caa8d
- SSDEEP 12288:eUkJjPQ6tRGtAM9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nImg02Y:MJjPftRGtAM9PZRwBgNYChF+plibi4HA
- TLSH
  T1E9D40A0BEB81173D09A06697FB0845B7FB5D626CC770B2BADDA982310966DFC10BD1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 971KB
- SHA256 b43249afabe7397c2edfbe6db7d958e5b769288f38089f388697f26ff8de3f70
- MD5 4c2fa611ed1e28a09ef7f87b6144118f
- SHA1 49a37f5050dd83b1aaadd481d4628ca10f7fe1d6
- SHA512 1778eb617265762660c32db151b0a964442a7f4d5510a684e4bb7c62b6ad7976996998a02c5ca64b432c408e7a28d02c0a272e1d2030c53d00d1335db1a7b600
- SSDEEP 24576:jgJeTx1A5t7hTCKPyaEVxsxHjnwvxehz+dIXV6sciy4VdeZtP9oPYOH+:jgJu
- TLSH
  T16F25AB547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 c3e70424c99efe86563be417ca202540eea7edcf3c794db8144578d7c069b207
- MD5 99215ba6570f75471dd4380a16585d93
- SHA1 b3f5fff239a6deb708cda28362b4612143f29d76
- SHA512 31d72a4856a02b60591aa0afe8a97b45e1b6814d3a8942857877a8d400102876769ef8124b727a6a48d9ca257455a776cf335f530b0e3010f5a7ec697198d59e
- SSDEEP 12288:XFDzZ0BmdpLFB62Ga9mwj3o0oCbv4UGP6k82/SLZNj6EuDb6NPz:XVzyEr
- TLSH
  T118358AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 8709a84ee1a5e11d47b2257de317cc8862431e2b8753c9dc63113274419ddc12
- MD5 9431678970d94056b3ed1909d538444e
- SHA1 87d74b4aa2f779d5b0d792f6e444a685560f4eb0
- SHA512 75f9f6f3a94a0cba3d001378ed4e046799e2e3c94fd0b73af56f0aaa4766545ec63315067cdef0693ff0ea1dd59d3c994a35ac99254f75e609a9647b2a2503f7
- SSDEEP 24576:95kpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDNiJw74uOVnaJcuSMTE:95kpWclYLYAmUUPVb6nNo7j373ZKmy3T
- TLSH
  T1D63525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 a499c2171370db5d8b5a7ed536d7da0f2a85712417cfd5381d20aaff3a2a134c
- MD5 7e156e341f564b8686ad4835e2356f57
- SHA1 895b79881d921659128f52de475aaa655d61bddb
- SHA512 b1296bd7cd68f43add998ec4a6810f7dfa827918262be91dc0189b31d5b31352d7e7cece81bf904a8b94ce60530034bdf27083c2395f330ca97a55aba4975f17
- SSDEEP 3072:qRe/KldNrNYD7j2QJOy8xTn/bPlM2COUzhqygYfj8tRq+vyQZWUBbXUOQSakwi04:qblLNeyQkyALJ1yQZWUBbFwdTM
- TLSH
  T1C865EF209C6E81B6A8C5CDC9434C6370C123AE9B9B61F74DDC17A15938ADC7C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 675KB
- SHA256 6593826d70efc1797cf6075af8e85877a1eed16632e9e13b21669acba62a8291
- MD5 0fc386e7bf7ee9e28b15997a472702be
- SHA1 e66a760cf2d70a593bc2e01ac9bc2a3b4dd26ff5
- SHA512 ec1188a272f4f2b02f51e9f4badfe2c505446585ed81734e2eb0e1bec7c9b859c7e36bab5e25779c112b0069c217ad8fb3aaaf8bda0763a4907aebdc1113b6ee
- SSDEEP 12288:6KH7IO4yCiX76gpFa8H5PsFBN3Mw2juwwPR9zejm0t3l76FTZKmwCRYJi4wNLrWL:rY/lpLn618IM0ahfilziQ
- TLSH
  T152E408239FC93B7704D2330EFB46C253B48CA9847A16D254F4AE1B1622CCA9CD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32