{"id":10316,"date":"2024-12-11T10:31:03","date_gmt":"2024-12-11T10:31:03","guid":{"rendered":"\/cybersecurity-blog\/?p=10316"},"modified":"2024-12-11T10:31:04","modified_gmt":"2024-12-11T10:31:04","slug":"nova-keylogger-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/nova-keylogger-malware-analysis\/","title":{"rendered":"Analysis of Nova: A Snake Keylogger Fork"},"content":{"rendered":"\n

Editor\u2019s note: The current article is authored by Mostafa ElSheimy, a malware reverse engineer and threat intelligence analyst. You can find Mostafa on <\/em>X<\/em><\/a> and <\/em>LinkedIn<\/em><\/a>.<\/em> <\/p>\n\n\n\n

In this malware analysis report, we will delve into Nova, a newly discovered fork of the Snake Keylogger family. This variant has been observed employing even more sophisticated tactics, signaling the continued adaptation and persistence of the Snake malware family in the cybersecurity landscape. <\/p>\n\n\n\n

Overview of Snake Keylogger<\/strong> <\/h2>\n\n\n\n

Snake Keylogger, a .NET-based malware first identified in November 2020, is infamous for its credential-stealing and keylogging capabilities.<\/p>\n\n\n\n

Read in-depth analysis of Snake Keylogger<\/a><\/p>\n\n\n\n

It primarily spreads through phishing and spearphishing<\/a> campaigns, where malicious Office documents or PDFs are used to deliver downloader scripts via PowerShell<\/a>. Once executed, Snake Keylogger captures keystrokes, steals saved credentials, takes screenshots, and extracts clipboard data. <\/p>\n\n\n\n

As of 2024, Snake Keylogger has continued to evolve, adopting advanced evasion techniques such as process hollowing and heavily obfuscated code to avoid detection.  <\/p>\n\n\n\n

This variant uses a suspended child process to inject its payload, which makes it more difficult for security software to identify and neutralize. Furthermore, reports indicate that Snake Keylogger has grown more prevalent, with significant spikes in zero-day detections, suggesting its ongoing threat to both personal and corporate cybersecurity. <\/p>\n\n\n\n

Technical Analysis Using ANY.RUN Sandbox<\/strong> <\/h2>\n\n\n\n

Let\u2019s run a sandbox analysis session using ANY.RUN’s Interactive Sandbox<\/a> to discover the technical details of this malware.  <\/p>\n\n\n\n

View analysis session<\/a> <\/p>\n\n\n

\n
\"\"
Process graph generated by ANY.RUN sandbox for the behavior of NOVA<\/em><\/figcaption><\/figure><\/div>\n\n\n

In the HTTP Requests tab, we can see that Nova sends HTTP Requests to hxxp[:\/\/]checkip[.]dyndns[.]org\/<\/strong> to get the IP of the victim device: <\/p>\n\n\n

\n
\"\"
HTTP requests to victim devices<\/em><\/figcaption><\/figure><\/div>\n\n\n

In DNS requests tab, Nova makes DNS requests to reallyfreegeoip[.]org<\/strong> to get the country name of the victim device: <\/p>\n\n\n

\n
\"\"
DNS requests by Nova to get the country name of the victim device<\/em><\/figcaption><\/figure><\/div>\n\n\n\n
\n\n

\nAnalyze malware and phishing
with ANY.RUN’s Interactive Sandbox<\/span>  \n<\/p>\n\n\nSign up free\n<\/a>\n<\/div>\n\n\n\n