Overview

overview

8

Static

static

1

NovaInstaller (1).exe

windows7-x64

7

NovaInstaller (1).exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NovaInstaller (1).exe

  • Size

    24.0MB

  • Sample

    240705-qwy4ja1hng

  • MD5

    4a370bd6e14c4a9f5443933b57b1f236

  • SHA1

    e5a4bdcc06fa0bc15be207c7e1bae58319a277fc

  • SHA256

    f1f376d63b5f6e7cecfca6c2bdb398f16304abed04827953879f317ea0d439d0

  • SHA512

    045c9825fcc83d56d0b1b5e505154e48429632b3ad33ec2d4a266e7f32e3af7fc9b482098c9301b9892fbd50742c2c9d94cdb2d32ee7f937c6c9b6cde3d25180

  • SSDEEP

    393216:imq7HyOhKNtFLG+uP0RNONd1z5KvK5BXJbOZ7YFevRPYD:im2KLJRuM/O5z5zcmFURU

Score
8/10
defense_evasionexecutionspywarestealer

Malware Config

Targets

    • Target

      NovaInstaller (1).exe

    • Size

      24.0MB

    • MD5

      4a370bd6e14c4a9f5443933b57b1f236

    • SHA1

      e5a4bdcc06fa0bc15be207c7e1bae58319a277fc

    • SHA256

      f1f376d63b5f6e7cecfca6c2bdb398f16304abed04827953879f317ea0d439d0

    • SHA512

      045c9825fcc83d56d0b1b5e505154e48429632b3ad33ec2d4a266e7f32e3af7fc9b482098c9301b9892fbd50742c2c9d94cdb2d32ee7f937c6c9b6cde3d25180

    • SSDEEP

      393216:imq7HyOhKNtFLG+uP0RNONd1z5KvK5BXJbOZ7YFevRPYD:im2KLJRuM/O5z5zcmFURU

    Score
    8/10
    defense_evasionexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks