General

  • Target

    0b01ec2c4b4faac5d7591c9b17d75d2d.bin

  • Size

    5.3MB

  • Sample

    240201-bh1mwaaabl

  • MD5

    11398eeb807c2f536119dcc77b6027e3

  • SHA1

    d7f3b9baf13e4b258a83daca4fd73877b349f73c

  • SHA256

    392508137e935d5eac76375c6489cb034517d9976fb844759236bddd393561c1

  • SHA512

    961f6c481924ec4a7210ca39e7c0104e8b93567ef959a12e37001b037031fcae6e055b54da0e87a1b084eb0b98d8e3f9b2b392b7dac5bb0cff1f9b88c3712f03

  • SSDEEP

    98304:psTRfVlAOr9AJiDfAS5f2maRA2FVJkNGU9zMee0qGzGGjMkIh3:uTRjxAJiTH+/pFV6wUzMejGGj5Id

Malware Config

Targets

    • Target

      e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe

    • Size

      5.3MB

    • MD5

      0b01ec2c4b4faac5d7591c9b17d75d2d

    • SHA1

      a28a8431348d751709887d1293c80237782ab6b6

    • SHA256

      e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060

    • SHA512

      b1e8ce594be3b14968899c3be2c8bf8e583645beb3e3ec383821fcac0b8c8bbd4ff72c32bd11fed4194fd2e0b00cc53652d16fbfec516655ec8a0472ea93b17e

    • SSDEEP

      98304:PKMBJC+aOomVZs3/H+ub898uncF7IsMZJ7ANoQbz5MYverP6JU+B59yO4SO:Ph++zg3/Hbb8GunsmJgMijJUnO

    • Detect Poverty Stealer Payload

    • Poverty Stealer

      Poverty Stealer is a crypto and infostealer written in C++.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks