Overview

overview

10

Static

static

8

832e5d6734...30.doc

windows7-x64

10

832e5d6734...30.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    832e5d6734d28e0576fcded20412cfe0335bcc0dad067fe1a9ae345891848730

  • Size

    46KB

  • Sample

    231117-lqhr5shf9v

  • MD5

    22ec6c0a1b5690a63c28f20b552ba7c6

  • SHA1

    c5554c56d4d45978c192b292f08b28171f949393

  • SHA256

    832e5d6734d28e0576fcded20412cfe0335bcc0dad067fe1a9ae345891848730

  • SHA512

    2a52de8efef7eeade654c22fab186ed410ae9f7782c0fe94f268eff5851a897bb3bce8a8c376a8d020ef2837fbaed10c98c32b4d3ba9bb25fbb184cd71f6e6ee

  • SSDEEP

    384:FAu0FtlGJiS8px8SMDYCX/chqTKnhtVgUNai92ufcM7QeWN0jl:Cu0Lp3yRTUNaiYNMW

Score
10/10
povertystealermacromacro_on_actionpersistencestealer

Malware Config

Targets

    • Target

      832e5d6734d28e0576fcded20412cfe0335bcc0dad067fe1a9ae345891848730

    • Size

      46KB

    • MD5

      22ec6c0a1b5690a63c28f20b552ba7c6

    • SHA1

      c5554c56d4d45978c192b292f08b28171f949393

    • SHA256

      832e5d6734d28e0576fcded20412cfe0335bcc0dad067fe1a9ae345891848730

    • SHA512

      2a52de8efef7eeade654c22fab186ed410ae9f7782c0fe94f268eff5851a897bb3bce8a8c376a8d020ef2837fbaed10c98c32b4d3ba9bb25fbb184cd71f6e6ee

    • SSDEEP

      384:FAu0FtlGJiS8px8SMDYCX/chqTKnhtVgUNai92ufcM7QeWN0jl:Cu0Lp3yRTUNaiYNMW

    Score
    10/10
    povertystealerpersistencestealer

    • Detect Poverty Stealer Payload

    • Poverty Stealer

      Poverty Stealer is a crypto and infostealer written in C++.

      stealerpovertystealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks