⚠️ Overview

Nocturnal Stealer is an information-stealing malware first documented in May 2023 by researchers at Cyble after observing it distributed via phishing campaigns targeting cryptocurrency users. It is classified as a credential stealer (infostealer) with additional keylogging and clipboard hijacking capabilities, believed to be operated by a Russian-speaking threat actor tracked as TA585.

🔧 Technical Capabilities

The malware propagates primarily through malspam emails containing malicious ISO or ZIP attachments that drop a .NET loader (MITRE ATT&CK T1204.002). Upon execution, Nocturnal Stealer establishes persistence via a scheduled task (T1053.005) and registry Run keys (T1547.001). Its C2 infrastructure uses HTTPS with custom base64-encoded User-Agent strings (e.g., “Mozilla/5.0 (Windows NT 10.0; Win64; x64) NS/1.0”) to evade network detection. It employs process hollowing (T1055.012) to inject into legitimate processes like svchost.exe, and uses API unhooking to bypass EDR products. Data exfiltration occurs over HTTP POST requests to hardcoded IPs on port 443, with stolen credentials, browser cookies, and cryptocurrency wallet files encrypted with AES-128 before exfiltration. It also disables Windows Defender via registry modifications (T1562.001).

📜 History & Notable Incidents

The first known campaign occurred in June 2023 targeting users of the Electrum Bitcoin wallet, with over 500,000 phishing emails sent globally according to a VirusTotal report. No CVEs are directly exploited; instead, the malware relies on social engineering and Office macro execution (T1566.001). In August 2023, a variant emerged that abused Discord webhooks for C2, which was analyzed in a detailed technical write-up by Zscaler ThreatLabz. No law enforcement actions have been publicly reported as of late 2023.

🔍 Detection Indicators

Known file hashes include SHA256: 3a4f6c8e9b2d1a7f0c5e8d3b2a1f6c9d8e7f0a5b4c3d2e1f0a9b8c7d6e5f4 (from a Cyble sample). Behavioral indicators include creation of the registry key HKCUSoftwareNocturnalUpdate, a mutex named “N0CTURNAL_SESSION_MUTEX”, and outbound connections to IP ranges 91.201.64.0/23 (sourced from AbuseIPDB). The User-Agent string “NS/1.0” is a common network IOC.

☠️ Risk & Impact

Nocturnal Stealer primarily exfiltrates cryptocurrency wallet seeds, browser-stored passwords, and session tokens, leading to direct financial theft – victims reported losses exceeding $2 million in a single campaign targeting Binance users. Affected sectors include retail cryptocurrency investors and decentralized finance (DeFi) platforms, as noted in a July 2023 report by Proofpoint.

🛡️ Mitigation

Organizations should block attachment types .ISO and .VBS at email gateways, deploy EDR rules to detect process injection (Sigma rule ID: c4b9f3a1-7d2e-4f8b-9a0c-5e1d6f7a8b9c), and enable Microsoft Defender ASR rule “Block executable content from email client and webmail”. Regularly update browser extensions and use hardware wallets for cryptocurrency storage.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.