povertystealer | 0ed6a0b8cd30d1be2a7539e9634b8c94853cfc8bd52bee3c966171223b939b8d

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 03:33

Target

Microfy.exe
Size

231KB
MD5

c91247e075f4e6fca603f8338427f9c5
SHA1

0434f0e193696cdeaef270876e9f5b272331f4ca
SHA256

0ed6a0b8cd30d1be2a7539e9634b8c94853cfc8bd52bee3c966171223b939b8d
SHA512

9bb8fa9725cc673b2942471f6e944d5b7adaf2a21aed904f87fa805c5ee64623f95268a2ea928ab06a1128f81b1f7fa49e9dd40087262f436a9dce4bd5d44ebd
SSDEEP

6144:3GYiKL/yfYb5B+BO99c0s0ZVtAO0gB6FTzOE9:2Y//yfYb5BIQZVt2dTzX9

Score

10^/10

Detect Poverty Stealer Payload 5 IoCs

resource	yara_rule
behavioral1/memory/1244-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1244-3-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1244-6-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1244-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral1/memory/1244-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1244	2016	Microfy.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	1244	WerFault.exe	29

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 2016 wrote to memory of 1244	2016	Microfy.exe	29
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30
PID 1244 wrote to memory of 2636	1244	AppLaunch.exe	30

memory/1244-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1244-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1244-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download