Overview

overview

8

Static

static

3

NovaCleaner.exe

windows10-2004-x64

7

NovaCleaner.exe

windows11-ltsc_2024-x64

7

rat.pyc

windows10-2004-x64

3

rat.pyc

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    600s
  • max time network
    453s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 19:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NovaCleaner.exe
  • Size 115.3MB
  • Sample260905-yefjvsyscx
  • SHA256 453d61394a88a479d40b5c611ba95a2f3ad9c40a5c921b9236dbb0e93abd461a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6088
    • C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\NovaCleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1376
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5860

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\Qt5\bin\MSVCP140.dll
          • Size 576KB
          • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\Qt5\bin\MSVCP140_1.dll
          • Size 30KB
          • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\Qt5\bin\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
          • Size 43KB
          • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtCore.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\QtCore.pyd
          • Size 2.4MB
          • SHA256 203bb6236f23f57ad8cdab5bbf4537a4abbc0b0879cf2893a8dc930e679dd846
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sip.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\PyQt5\sip.cp310-win_amd64.pyd
          • Size 120KB
          • SHA256 610c310522f9ad4276df1d1ab7351f719a980e98ec5122e6f2d07685279847f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\VCRUNTIME140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_asyncio.pyd
          • Size 60KB
          • SHA256 2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_bz2.pyd
          • Size 78KB
          • SHA256 31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_cffi_backend.cp310-win_amd64.pyd
          • Size 175KB
          • SHA256 e029cabce12aea3d77f2c8709a0f4be695f3fedd1144c14607b4fcc3b9e9bc3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_ctypes.pyd
          • Size 117KB
          • SHA256 b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_decimal.pyd
          • Size 242KB
          • SHA256 4f1ecc777c30df39cd70600cd0c9dc411adb622af86287b612f78be2a23b352c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_elementtree.pyd
          • Size 122KB
          • SHA256 fecc11695287d3972ab854530fc83445eee323f82074e2bef7f86ab4949b6497
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_hashlib.pyd
          • Size 60KB
          • SHA256 9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_lzma.pyd
          • Size 151KB
          • SHA256 75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_multiprocessing.pyd
          • Size 30KB
          • SHA256 b2d81c59e7ba45ce85f557c67a02ebbb01433136b6dd5075afcf115f57b73115
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_overlapped.pyd
          • Size 45KB
          • SHA256 622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_queue.pyd
          • Size 27KB
          • SHA256 827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_socket.pyd
          • Size 74KB
          • SHA256 9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_sqlite3.pyd
          • Size 93KB
          • SHA256 6dfb89e5c0b6c5c81ab081d3fdf5f35921466d2ddcede5394d3c4516655b66e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_ssl.pyd
          • Size 153KB
          • SHA256 41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_tkinter.pyd
          • Size 61KB
          • SHA256 3ddcdec7a7a9b01f1af5a57f3cd66ae68883416fa7fb6aa7fa51b9cf1c24bf07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\_uuid.pyd
          • Size 21KB
          • SHA256 4ed9e84185b34923193f84255f7aa6ca6e6312c490b32de4acf0a0facbabdb5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\base_library.zip
          • Size 859KB
          • SHA256 4dfb0f797cb2d79d31d10f2427b0476cac606db8d616a00de5ed2c966d28768a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\libssl-1_1.dll
          • Size 682KB
          • SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\multidict\_multidict.cp310-win_amd64.pyd
          • Size 77KB
          • SHA256 722e3bc918b47b78e0e560864bd870b51af33f7dfdf77b54f2a99b3c5009ed94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\pyexpat.pyd
          • Size 191KB
          • SHA256 e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\python3.DLL
          • Size 61KB
          • SHA256 a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\python310.dll
          • Size 4.2MB
          • SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\select.pyd
          • Size 26KB
          • SHA256 149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\sqlite3.dll
          • Size 1.4MB
          • SHA256 4b3f88de7acfcac304d1d96f936d0123ad4250654e48bd412f12a7bd8ec7ebb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\tcl86t.dll
          • Size 1.8MB
          • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\tk86t.dll
          • Size 1.5MB
          • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000017c82\unicodedata.pyd
          • Size 1.1MB
          • SHA256 0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmpsmnw725x
          • Path C:\Users\Admin\AppData\Local\Temp\tmpsmnw725x
          • Size 20KB
          • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmpyb2qfie1
          • Path C:\Users\Admin\AppData\Local\Temp\tmpyb2qfie1
          • Size 24KB
          • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4664-1190-0x00007FFE61CC0000-0x00007FFE61F20000-memory.dmp
          Download

          memory/4664-1224-0x000002CE0FE60000-0x000002CE0FE61000-memory.dmp
          Download

          memory/4664-1225-0x000002CE0FE60000-0x000002CE0FE61000-memory.dmp
          Download