NOVA: blast from the past
The BI.ZONE Threat Intelligence team continues to record a large‑scale campaign targeting Russian organizations across various industries. The adversaries employ NOVA stealer, a new commercial fork of SnakeLogger, with subscriptions starting at $50. They distribute phishing emails with the malware disguised as a contract archive.
- Threat actors actively leverage malware as a service (MaaS) marketed on underground resources, enabling them to save resources and focus on its spread.
- Attackers increase their chances of success by using popular file names for malicious archives and targeting employees in organizations that handle high volumes of emails.
- Stealers remain a major cybersecurity threat: authentication data harvested through such malware can be leveraged in the future, for instance, in targeted ransomware attacks.
As part of this campaign, the adversaries distribute NOVA via archive attachments to phishing emails, disguising them as contracts (e.g., Договор.exe). It is noteworthy that the attackers do not use double file extensions or fake icons to make the malicious file appear as a legitimate document.
Once executed, the malicious file decodes data steganographically concealed in zabawa2, replicates itself under a different name in the AppData\Roaming directory, and runs PowerShell to add itself to the Microsoft Defender exclusions list:
Add-MpPreference -ExclusionPath "C:\Users\%USERNAME%\AppData\Roaming\%FILENAME%.exe"
It gains persistence to the compromised system by exploiting the Windows Task Scheduler:
schtasks.exe" /Create /TN "Updates\wZhPqlmXA" /XML "C:\Users\%USERNAME%\AppData\Local\Temp\tmp46B8.tmp"
Finally, the malicious file executes itself in a suspended state and injects the decoded payload into a spawned child process.
The API call sequence is as follows: CreateProcessInternalA (suspended) → VirtualAllocEx → WriteProcessMemory → SetThreadContext → ResumeThread.
Curiously enough, the malicious file includes strings in Polish.
Strings in the file code
The malicious payload injected is the NOVA stealer, a fork of the popular SnakeLogger stealer.
To get the IP and country details of a compromised system, NOVA queries web resources such as checkip[.]dyndns[.]org or reallyfreegeoip[.]org.
The malware steals saved credentials from various sources, captures keystrokes, takes screenshots, and extracts clipboard data.
Retrieving saved credentials from Mozilla Firefox
Keystroke logging
Taking screenshots
In this particular case, the retrieved data is exfiltrated via SMTP.
Retrieved data exfiltration configuration
This sample may also have the following capabilities:
- disable Microsoft Defender and Task Manager
- disable the Registry Editor
- disable CMD
The stealer contains functions with respective names but lacks the code required to execute them.
Stealer code functions
Additionally, we detected a function that constrains malware execution until a particular date.
Function that constrains malware execution until a particular date
NOVA is marketed under the MaaS model, making it accessible to a wide range of attackers.
In August 2024, the NOVA Telegram group was created to promote and sell the stealer, as well as to provide tech support.
Apart from the stealer, the developer offers a cryptor, with the stealer price ranging from $50 for a 30‑day license up to $630 for a lifetime license, and the cryptor price, from $60 for a 30‑day license to $150 for a 90‑day license.
831582068560462536daaeef1eff835315de4683cf8bed4d31660bdd69dca14ec4b713538004a9c84332b68b0a613a5de9dcf639e415feb14b3da926e164375f3c5a3609
| Tactic | Technique | Procedure |
|---|---|---|
| Initial Access |
Phishing |
NOVA is distributed via phishing emails |
| Execution |
User Execution: Malicious File |
NOVA’s code is executed once a user opens the malicious file |
|
Command and Scripting Interpreter: PowerShell |
The NOVA loader leverages PowerShell to execute commands—namely, to add itself to the Microsoft Defender exclusions list |
|
| Defense Evasion |
Impair Defenses: Disable or Modify Tools |
NOVA has the capabilities to disable CMD, Registry Editor, Task Manager, and other system components, and can add itself to antivirus exclusions |
|
Obfuscated Files or Information: Steganography |
The NOVA loader employs steganography to conceal payloads |
|
|
Obfuscated Files or Information: Encrypted/Encoded File |
The stealer payload is encrypted |
|
|
Deobfuscate/Decode Files or Information |
NOVA decodes the payload before injecting it |
|
|
Masquerading |
NOVA often uses file names that mimic legitimate ones (e.g., |
|
|
Process Injection: Process Hollowing |
NOVA injects code into a spawned child process |
|
|
Execution Guardrails |
NOVA utilizes a logic bomb constraining execution until a particular date specified in its configuration |
|
| Collection |
Screen Capture |
NOVA takes screenshots |
|
Clipboard Data |
NOVA reads clipboard data |
|
| Discovery |
System Location Discovery |
NOVA retrieves country and region information using IP services like |
| Credential Access |
Unsecured Credentials: Credentials In Files |
NOVA is capable of stealing credentials from unsecured repositories |
|
Credentials from Web Browsers |
NOVA extracts credentials from a wide range of browsers (Edge, Firefox, Chrome, etc.) |
|
|
Credentials from Password Stores |
NOVA steals credentials from password stores of mail (Outlook) and FTP clients |
|
|
Input Capture: Keylogging |
NOVA captures keystrokes (keylogger functionality) |
|
| Exfiltration |
Exfiltration Over Alternative Protocol |
NOVA can exfiltrate credentials via SMTP and FTP, depending on the sample configuration |
|
Exfiltration Over Web Service |
NOVA can exfiltrate data via Telegram and its API, depending on the sample configuration |
|
| Persistence |
Scheduled Task |
NOVA autoruns itself via the Windows Task Scheduler |
The BI.ZONE EDR rules below can help organizations detect the described malicious activity:
win_new_windows_defender_exception_was_addedwin_using_schtasks_to_create_suspicious_taskwin_access_to_ip_detection_servicewin_possible_browser_stealer_activity
To ensure proactive protection, you need to stay ahead of threat actors by monitoring compromised corporate accounts on underground resources. The BI.ZONE Threat Intelligence portal can be a valuable solution in this regard, offering, among other things, information about data leaks. The portal allows you to look for compromised accounts by a specific email address, an email domain (including all its subdomains), or by a particular URL.