453d61394a88a479d40b5c611ba95a2f3ad9c40a5c921b9236dbb0e93abd461a

General

Target
NovaCleaner.exe
Size 115.3MB
Sample260905-yefjvsyscx
SHA256 453d61394a88a479d40b5c611ba95a2f3ad9c40a5c921b9236dbb0e93abd461a
MD5 be140ff8ceaa81ce7566b3939c727b91
SHA1 b7ae5c6a1546ae58e81776696e6c4b27d6746868
SHA512 8c2ebeeb57b8db381a1a2f9b8eaff409542f31c3d458ad0ab3ae4550ee7aa83147264369b3a4d99060c5469ba2542ec220cdc049e361d1894de4255bad72b249
SSDEEP 3145728:2PgYRPSC++6y926pJWI5BBNGPr6tE0WxeM:mxaC4y9266s1uunWx
TLSH
T1FE483310D5B9569FF1190633D8F29746AFC6305F8B7341EA92D84243CAAB1C1EFF9862
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NovaCleaner.exe
- Size 115.3MB
- SHA256 453d61394a88a479d40b5c611ba95a2f3ad9c40a5c921b9236dbb0e93abd461a
- MD5 be140ff8ceaa81ce7566b3939c727b91
- SHA1 b7ae5c6a1546ae58e81776696e6c4b27d6746868
- SHA512 8c2ebeeb57b8db381a1a2f9b8eaff409542f31c3d458ad0ab3ae4550ee7aa83147264369b3a4d99060c5469ba2542ec220cdc049e361d1894de4255bad72b249
- SSDEEP 3145728:2PgYRPSC++6y926pJWI5BBNGPr6tE0WxeM:mxaC4y9266s1uunWx
- TLSH
  T1FE483310D5B9569FF1190633D8F29746AFC6305F8B7341EA92D84243CAAB1C1EFF9862
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  rat.pyc
- Size 19KB
- SHA256 5c733e7dd7427d3c7deb523d7015a768e1bdfe7f5da1b98a1a9b46e3473ba076
- MD5 a45119ef928aa8246ca0f16b413dba6b
- SHA1 743a98709d62bc0b340f3ea84ff03f15121b455f
- SHA512 0fbfa72886c7683ff110e0c16d1f9380abf3e2fa0ca6c867a0a6424b3583129ec0fb12fc4e427af3cea04300b9811119533f6832cef1505f05b57d45df023637
- SSDEEP 384:Dl0eYEb24CNgp1FNIyosOGIKXXi3PPFlG03az8k:DSCbIsFaHAIKXS3XHLvk
- TLSH
  T14892D8F57068161BFEB6F374A0C057701A28B2766348A22B4548FDA6BF4C3B40D696DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4