novablight | 899b503cd15ddd4c646dc04c09d1042ac0b6f54b792752090bd1b8a6abbf0b43

General

Target
arrival.7z
Size 68.2MB
Sample260629-2z3rnsat3j
SHA256 899b503cd15ddd4c646dc04c09d1042ac0b6f54b792752090bd1b8a6abbf0b43
MD5 21cc6279d01d9e37df732de35c64fe11
SHA1 ef7b3cb7b5d9d641bdf1c4c770a5db40f6eada39
SHA512 11627185628e58de22591b9c43892a17ad6f3b97651eac5809b5a37a43634629e25e939188e7cb736e1f503762f40807eda4ca5cce51b43d3e6580d5f73defb1
SSDEEP 1572864:Y4gPXMom45pRgMx0aisRdDB4j7W16r4cIqQp5GyW6ucS3:Y4AcN45jgMx0J7ogI3W9cS3
TLSH
T1ADF73385834E5B97CB15C26100DD07225A7F9BDBA528C80EF562FDFCF0896670D4B6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Stellarconquest.exe
- Size 164.7MB
- SHA256 f550ad04bdb71b5b4d46405fcdc3ea5d3e9437b2a0e4927db2eacf10bd1b7032
- MD5 27b5084b6968e0b0c31eefbd90c1787c
- SHA1 e82d75bd3c88d950e774b542d94c2f9befd7d310
- SHA512 1dd4dd841517c47a2cb1eefa830fb905006d832648e3830f89cd3bda2e7fe3fa54ee5e63e535da85cb76a9b3bf109cd20bdd958b0948e2250d1b2e3c92a04144
- SSDEEP 1572864:YxGeD65iMor30uXkaYCELW0ejTV1FQ3mRVvHTxnHqVstmZC/wu32Q/djfP85WhkF:reJEhTWTjiWhS
- TLSH
  T193888B03F29651E8F05DD1B18B578236EA72B8861739A6DF175407662F3BFE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution exploit novablight impact persistence privilege_escalation ransomware spyware stealer trojan
- Detects Novablight infostealer
- Family: Novablight
  Novablight is an infostealer written in NodeJS operating as a Malware-as-a-Service.
  stealer novablight
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Creates new service(s)
  persistence execution
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1