Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Once Nocturnal Stealer is done searching for relevant data, zipping data to be exfiltrated, and sending it to the C&C, it runs a simple command to kill the stealer task as well as remove the dropped files: cmd.exe /c taskkill /im <random_digits>.exe /f & erase C:\ProgramData\Nocturnal<System_UUID>\<random_digits>.exe & exit
To avoid detection, Nocturnal Stealer uses several anti-VM and anti-analysis techniques, which include but are not limited to: environment fingerprinting, checking for debuggers and analyzers, searching for known virtual machine registry keys, and checking for emulation software.
The stolen data for targeted browsers includes login credentials, cookies, web data, autofill data, and stored credit cards.
Upon execution, Nocturnal Stealer searches the '%LOCALAPPDATA%' directory for any sensitive data or files related to the browsers, cryptocurrency wallets, and FTP clients it currently targets. If found, the malware copies data into the 'passwords.txt' file. The stolen data for targeted browsers includes login credentials...
This includes system information such as machine ID, date/time, installation location, operating system, architecture, username, processor type, video card, and a list of all running processes.
This includes system information such as machine ID, date/time, installation location, operating system, architecture, username, processor type, video card, and a list of all running processes.
To avoid detection, Nocturnal Stealer uses several anti-VM and anti-analysis techniques, which include but are not limited to: environment fingerprinting, checking for debuggers and analyzers, searching for known virtual machine registry keys, and checking for emulation software.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.