Discord Nitro gift codes now demanded as ransomware payments

[mood]

Discord Nitro gift codes now demanded as ransomware payments

 

 

In a novel approach to ransom demands, a new ransomware calling itself 'NitroRansomware' encrypts victim's files and then demands a Discord Nitro gift code to decrypt files.

 

While Discord is free, they offer a Nitro subscription add-on for $9.99 per month that provides additional perks, such as larger uploads, HD video streaming, enhanced emojis, and the ability to boost your favorite server, so its users enjoy extra functionality as well.

 

When purchasing a Nitro subscription, users can apply it to their own account or buy it as a gift for another person. When gifting, the purchaser will be given an URL in the format https://discord.gift/[code], which can then be given to another Discord user.

 

Gifting a Nitro subscription

Not your typical ransom demand

While most ransomware operations demand thousands, if not millions, of dollars in cryptocurrency, Nitro Ransomware deviates from the norm by demanding a $9.99 Nitro Gift code instead.

 

Based on filenames for NitroRansomware samples shared by MalwareHunterteam and analyzed by BleepingComputer, this new ransomware appears to be distributed as a fake tool stating it can generate free Nitro gift codes.

 

When executed, the ransomware will encrypt a person's files and append the .givemenitro extension to encrypted files, as shown below.

 

Files encrypted by the NitroRansomware

 

When finished, NitroRansomware will change the user's wallpaper to an evil or angry Discord logo, as shown below.

 

Wallpaper changed to angry Discord logo

 

A ransomware screen will then be displayed demanding a free Nitro gift code within three hours, or ransomware will delete the victim's encrypted files. This timer appears to be an idle threat as the ransomware samples seen by BleepingComputer do not delete any files when the timer reaches zero.

 

NitroRansomware screen

 

When a user enters a Nitro gift code URL, the ransomware will verify it using a Discord API URL, as shown below. If a valid gift code link is entered, the ransomware will decrypt the files using an embedded static decryption key.

 

Checking if a Discord Nitro gift code is valid

 

As the decryption keys are static and are contained within the ransomware executable, it is possible to decrypt the files without actually paying the Nitro gift code ransom.

 

Therefore, if you fall victim to this ransomware, you can share a link for the executable to extract a decryption key.

 

Unfortunately, in addition to encrypting your files, the Nitro Ransomware will also perform other malicious activity on a victim's computer.

Stealing tokens and executing commands

It would not be Discord-related malware if the threat actors didn't try to steal a victim's Discord tokens.

 

Discord tokens are authentication keys tied to a particular user, that when stolen, allow a threat actor to log in as the associated user.

 

When NitroRansomware starts, it will search for a victim's Discord installation path and then extract user tokens from the *.ldb files located under "Local Storage\leveldb." These tokens are then sent back to the threat actor over a Discord webhook.

 

Stealing Discord user tokens

 

NitroRansomware also includes rudimentary backdoor capabilities that allow the threat actor to remotely execute commands and then have the output sent through their webhook to the attacker's Discord channel.

 

Acting as a backdoor to execute remote commands

 

The good news is that this ransomware does not do a good job hiding its decryption key, and users can recover their files for free.

 

However, the bad news is that the threat actor will likely have already stolen a user's Discord token and potentially executed further commands on an infected device.

 

Due to this, users infected with this ransomware should immediately change their Discord password and perform an antivirus scan to detect other malicious programs added to the computer.

 

It is also suggested that users check for new user accounts in Windows that they did not create and remove them if found.

 

 

Source: Discord Nitro gift codes now demanded as ransomware payments