Overview

overview

8

Static

static

3

NovaCleaner.exe

windows10-2004-x64

7

NovaCleaner.exe

windows11-ltsc_2024-x64

7

rat.pyc

windows10-2004-x64

3

rat.pyc

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    4s
  • max time network
    11s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/09/2026, 19:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NovaCleaner.exe
  • Size 115.3MB
  • Sample260905-yefjvsyscx
  • SHA256 453d61394a88a479d40b5c611ba95a2f3ad9c40a5c921b9236dbb0e93abd461a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1896
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3400

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 4.8MB
        • SHA256 1e6c5205b605205f62602541e22b8fa4468694e9f0e767b3c2f97644b776419e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 4.6MB
        • SHA256 53e88281a7e5cab0e233a437a15b8fa8f7d4dcf922887264461c626d813949b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 203bb6236f23f57ad8cdab5bbf4537a4abbc0b0879cf2893a8dc930e679dd846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\PyQt5\sip.cp310-win_amd64.pyd
        • Size 120KB
        • SHA256 610c310522f9ad4276df1d1ab7351f719a980e98ec5122e6f2d07685279847f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\VCRUNTIME140_1.dll
        • Size 36KB
        • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_asyncio.pyd
        • Size 60KB
        • SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_bz2.pyd
        • Size 78KB
        • SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_cffi_backend.cp310-win_amd64.pyd
        • Size 175KB
        • SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_ctypes.pyd
        • Size 117KB
        • SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_decimal.pyd
        • Size 242KB
        • SHA256 4f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_elementtree.pyd
        • Size 122KB
        • SHA256 fecc11695287d3972ab854530fc83445eee323f82074e2bef7f86ab4949b6497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_hashlib.pyd
        • Size 60KB
        • SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_lzma.pyd
        • Size 151KB
        • SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_multiprocessing.pyd
        • Size 30KB
        • SHA256 b2d81c59e7ba45ce85f557c67a02ebbb01433136b6dd5075afcf115f57b73115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_overlapped.pyd
        • Size 45KB
        • SHA256 622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_queue.pyd
        • Size 27KB
        • SHA256 827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_socket.pyd
        • Size 74KB
        • SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_sqlite3.pyd
        • Size 93KB
        • SHA256 6dfb89e5c0b6c5c81ab081d3fdf5f35921466d2ddcede5394d3c4516655b66e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_ssl.pyd
        • Size 153KB
        • SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_tkinter.pyd
        • Size 61KB
        • SHA256 3ddcdec7a7a9b01f1af5a57f3cd66ae68883416fa7fb6aa7fa51b9cf1c24bf07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\_uuid.pyd
        • Size 21KB
        • SHA256 4ed9e84185b34923193f84255f7aa6ca6e6312c490b32de4acf0a0facbabdb5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\base_library.zip
        • Size 859KB
        • SHA256 4dfb0f797cb2d79d31d10f2427b0476cac606db8d616a00de5ed2c966d28768a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\libssl-1_1.dll
        • Size 682KB
        • SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\pyexpat.pyd
        • Size 191KB
        • SHA256 e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\python3.DLL
        • Size 61KB
        • SHA256 a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\python310.dll
        • Size 4.2MB
        • SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\select.pyd
        • Size 26KB
        • SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\sqlite3.dll
        • Size 1.4MB
        • SHA256 4b3f88de7acfcac304d1d96f936d0123ad4250654e48bd412f12a7bd8ec7ebb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\tcl86t.dll
        • Size 1.8MB
        • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\tk86t.dll
        • Size 1.5MB
        • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000013902\unicodedata.pyd
        • Size 1.1MB
        • SHA256 0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1896-1190-0x00007FFB4C840000-0x00007FFB4CAA0000-memory.dmp
        Download