Overview

overview

10

Static

static

3

e8b02f4683...6d.exe

windows10-2004-x64

10

e8b02f4683...6d.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e8b02f4683dc4c841454495c018e6427781c830498fecb6c6d9381e6ab77f16d.zip
  • Size 2.0MB
  • Sample260715-1apyvaew4n
  • SHA256 72b4ed39dfb0fd8cc85ad30c25cf505775674d535f056c7d0a751f4cb8baa31f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
nova_ransomwarecredential_accessdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\95271251FF9A3DF72DAB0A98E77EA9248E3.README.txt

  • nova_ransomware

Ransom Note
  • # Nova Group Your unique network Id: 95271251FF9A3DF72DAB0A98E77EA9248E3 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] What happened? Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data.Each system in the network is encrypted with a unique identifier. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] What guarantees you have? We are a non-politically motivated international group from anywhere in the world, we care about nothing but your money You can send some encrypted files from your network and we will decrypt it for free. We value our reputation. If we do not fulfill our work and obligations, no one will pay us. It's not in our interest. All of our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] How to cantact with us? 1. Download and install Telegram Messenger (https://telegram.org). 2. Please contact with the ID https://t.me/NovaGroup2023 3. Or you can contact us via email at [email protected] ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+]Do you need forensics? Note that we are a professional team with different nationalities ransomware is a part of the world of cyber security, even big companies make payments, but no news is communicated to the outside world So we advise you not to talk to anyone about your business being hacked All logs are completely removed So you don't even know how you got hacked But don't worry, we will also provide you with a complete security report The virus has the ability to self-destruct, so reverse engineering is not possible ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] What will I get in case of agreement? You WILL GET full DECRYPTION of your machines in the network RECOMMENDATIONS for securing your network perimeter. And the FULL CONFIDENTIALITY ABOUT INCIDENT. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] Warnings! Do not go to recovery companies, they are just middlemen who will make money off you and cheat you. They secretly negotiate with us, buy decryption software and will sell it to you many times more expensive or they will simply scam you. In order to create a public decryption, the executable file of the virus needs to be available to reverse engineering experts, but since the program has the ability to self-destruct, so far no public file has been placed on the Internet So any claim of decryption by individuals is a scam ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [+] Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage
URLs

  • https://t.me/NovaGroup2023

Targets

    • Target
      e8b02f4683dc4c841454495c018e6427781c830498fecb6c6d9381e6ab77f16d.exe
    • Size 3.4MB
    • SHA256 e8b02f4683dc4c841454495c018e6427781c830498fecb6c6d9381e6ab77f16d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoverynova_ransomwarepersistenceransomwarespywarestealer

    • Family: Nova

      Nova is a ransomware that operates under a Ransomware-as-a-Service (RaaS) model.

      ransomwarenova_ransomware

    • Clears Windows event logs

      defense_evasionransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Power Settings

1
T1653

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

1
T1070

Clear Windows Event Logs

1
T1070.001

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

1
T1082

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks