Nova

Most information stealers are distributed using social engineering, phishing, and malvertising campaigns to collect sensitive information from a large number of targets.

The malware uses cmd.exe and powershell to interact with the registry extensively. It queries and modifies registry keys related to the system for persistence and configuration.

The malware drops Update[.]exe (renamed version of win32snapshot[.]exe) into the startup folder, indicating an attempt to achieve persistence.

The malware tries to load missing DLLs and creates processes in suspended mode for code injection.

The malware drops Update[.]exe (renamed version of win32snapshot[.]exe) into the startup folder, indicating an attempt to achieve persistence.

“Keenadu was also distributed via modified popular apps from unofficial stores and even Google Play, where trojanized smart camera apps with over 300,000 downloads…”

The malware tries to load missing DLLs and creates processes in suspended mode for code injection.

win32snapshot[.]exe (md5: 13639e7f3707d05d90798d21d404eccc), sets the “Circular Kernel Context Logger” registry key value to “0”. As a result, events related to kernel-mode operations, system calls, and other low-level activities will no longer be recorded.

It abuses the inbuilt Windows utility Data Protection Application Programming Interface (DPAPI) to perform data decryption. This API contains a class called ProtectedData, that contains two wrappers: “Protect” and “Unprotect.” The infostealer passes a byte array of the encrypted data to the “Unprotect” wrapper, which subsequently returns a byte array of decrypted data.

The malware uses cmd.exe and powershell to interact with the registry extensively. It queries and modifies registry keys related to the system for persistence and configuration.

This indicates the installation of a root certificate by the malware, which would allow an attacker to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.

The malware targets multiple browsers, including the most used Edge, Chrome and Firefox. Additionally, the malware invokes reg.exe to harvest information related to WinSCP, targeting stored sessions and passwords.

The Chrome configuration is stored in the local AppData directory in a file called “Local State”. This configuration contains an entry called “os_crypt,” which has a sub-entry called “encrypted_key.” The “encrypted_key” is used by Chrome to encrypt saved login data. Below we can see that the malware tries to access that.

The index[.]js file was responsible for stealing the Discord session token and collecting information about the victim.

The malware uses cmd.exe and powershell to interact with the registry extensively. It queries and modifies registry keys related to the system for persistence and configuration.

The malware uses utilities like wmic to gather various system information, including logical disk size, total physical memory, CPU information, UUID etc. The malware checks the online IP address of the machine, indicating an attempt to fingerprint victims.

The malware uses this open-source utility to capture the screenshot of the target machine.

Earlier this year, researchers discovered that the main.py file in the Sordeal repository (which has since been deleted) injected malicious Node.js code into the Discord %APPDATA%/Discord/app-(versions)/modules/discord_desktop_core/index.js module.

After decryption, the malware creates a folder in the temp directory and dumps all the decrypted information in the respective files.

Threat hunters often focus on spotting command-and-control (C2) servers, open directories typically identified by the phrase “Index of” and phishing components.

“Keenadu’s backdoor… loads extra malicious modules from its C2 server… The modules are downloaded from Amazon AWS, verified with MD5 and DSA signatures, then decrypted and executed.”

Almost one million patients had their data stolen, including basic personal information, highly sensitive Pap smear results, and skin and urine test results.

The attacker received this information, but a copy was also sent to hxxps[:]//panel[.]sordeal[.]com[:]3000/ using a POST method.

Impact Data Encrypted (T1486) AES-256/RSA-2048, .nova/.RALord ... Files are encrypted using AES-256 in Cipher Block Chaining (CBC) mode ... The AES key is then encrypted with the attacker's RSA-2048 public key.