ANY.RUN Reveals Advanced Tactics of Nova: A Newly Discovered Fork of Snake Keylogger
DUBAI, DUBAI, UNITED ARAB EMIRATES, December 11, 2024 /EINPresswire.com/ -- ANY.RUN's latest analysis dives into Nova, a newly discovered fork of the Snake Keylogger malware. With advanced obfuscation, stealthy memory-based operations, and flexible data theft techniques, Nova poses a real threat to both individuals and organizations. This analysis takes you inside Novaโs intricate methods, revealing how it silently exfiltrates sensitive information while evading modern security defenses.
๐๐ฏ๐๐ซ๐ฏ๐ข๐๐ฐ ๐จ๐ ๐๐จ๐ฏ๐: ๐๐ง๐๐ค๐ ๐๐๐ฒ๐ฅ๐จ๐ ๐ ๐๐ซโ๐ฌ ๐๐ฏ๐จ๐ฅ๐ฎ๐ญ๐ข๐จ๐ง
Snake Keylogger, first identified in 2020, is a notorious .NET-based malware designed to steal credentials, capture keystrokes, and exfiltrate sensitive information. Nova, its advanced fork, takes these capabilities to new heights, employing obfuscation techniques, process hollowing, and multi-method data exfiltration channels like Telegram.
๐๐๐ฒ ๐๐ง๐ฌ๐ข๐ ๐ก๐ญ๐ฌ ๐๐ซ๐จ๐ฆ ๐ญ๐ก๐ ๐๐ง๐๐ฅ๐ฒ๐ฌ๐ข๐ฌ
The in-depth technical analysis reveals several critical aspects of Novaโs operation:
๐ญ. ๐๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น ๐๐ต๐ฒ๐ณ๐: Nova extracts sensitive data from a variety of browsers, including Chrome, Firefox, Edge, and even less commonly used ones like Vivaldi and Brave.
๐ฎ. ๐๐ฎ๐๐ฎ ๐ฒ๐ ๐ณ๐ถ๐น๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐๐ฒ๐ฟ๐๐ฎ๐๐ถ๐น๐ถ๐๐: Depending on the attackerโs configuration, Nova can exfiltrate data via FTP, SMTP, or Telegram.
๐ฏ. ๐ฃ๐ฒ๐ฟ๐๐ถ๐๐๐ฒ๐ป๐ฐ๐ฒ ๐๐ต๐ฟ๐ผ๐๐ด๐ต ๐๐๐๐ผ๐๐: Nova employs AutoIt scripts to achieve persistence and obfuscation. It establishes scheduled tasks in Windows Task Scheduler to execute its scripts regularly, ensuring its activity continues without user awareness.
๐ฐ. ๐๐ ๐๐ฒ๐ป๐๐ถ๐๐ฒ ๐ฑ๐ฎ๐๐ฎ ๐ฐ๐ผ๐น๐น๐ฒ๐ฐ๐๐ถ๐ผ๐ป: Beyond credentials, Nova retrieves clipboard data, Windows product keys, and other system information, demonstrating its capability to gather a wide array of sensitive details.
๐๐ฆ๐ฉ๐ฅ๐ข๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐๐จ๐ซ ๐๐ฒ๐๐๐ซ๐ฌ๐๐๐ฎ๐ซ๐ข๐ญ๐ฒ
The Nova malware represents a critical evolution in the cyber threat landscape. Its advanced evasion techniques, comprehensive data extraction capabilities, and integration with popular platforms make it a severe risk to personal and corporate cybersecurity.
Organizations are urged to enhance their defenses and adopt proactive measures against this persistent threat.
Learn more on ANY.RUNโs blog.
๐๐๐จ๐ฎ๐ญ ๐๐๐.๐๐๐
ANY.RUN is a leading interactive malware analysis platform enabling real-time behavioral analysis for Windows and Linux systems. Its advanced threat intelligence tools, including YARA Search and TI Lookup, empower cybersecurity professionals to detect, analyze, and respond to threats faster and more effectively.
The ANY.RUN team
ANYRUN FZCO
+1 657-366-5050
email us here
Visit us on social media:
X
LinkedIn
1 https://any.run/?utm_source=ein&utm_medium=press_release&utm_campaign=nova-keylogger-malware-analysis&utm_content=landing&utm_term=111224
2 https://any.run/cybersecurity-blog/nova-keylogger-malware-analysis/?utm_source=ein&utm_medium=press_release&utm_campaign=nova-keylogger-malware-analysis&utm_content=blog&utm_term=111224
