Overview

overview

10

Static

static

3

8041fe2944...c0.exe

windows7-x64

7

8041fe2944...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8041fe294422821a4ff85656ecf7d780ea761163b06b966e126290988f093ac0.exe

  • Size

    1.4MB

  • Sample

    250123-3xzgxa1mhp

  • MD5

    74c1c83c732cfec9911b8b392dbf89b8

  • SHA1

    25ed13bd043b31ae55dac26010c48537ec733cce

  • SHA256

    8041fe294422821a4ff85656ecf7d780ea761163b06b966e126290988f093ac0

  • SHA512

    820ce9e2e562912b663e2aa9b34125009da95c133be4313ea242b9cf492e1fd9f12a2de8b3efee9d8d487f752df6332c9336fccd90374d872ccceea0631ebf92

  • SSDEEP

    24576:3Mjhfa5aaH+5vgpD650+RFo6kF/5SrkGB8PGqooMWiI05bmktUNudtJjdPrF:K/nog50+Ri6kokGB9qoC1ab7SNudXjdZ

Score
10/10
povertystealerdiscoveryexecutionstealer

Malware Config

Targets

    • Target

      8041fe294422821a4ff85656ecf7d780ea761163b06b966e126290988f093ac0.exe

    • Size

      1.4MB

    • MD5

      74c1c83c732cfec9911b8b392dbf89b8

    • SHA1

      25ed13bd043b31ae55dac26010c48537ec733cce

    • SHA256

      8041fe294422821a4ff85656ecf7d780ea761163b06b966e126290988f093ac0

    • SHA512

      820ce9e2e562912b663e2aa9b34125009da95c133be4313ea242b9cf492e1fd9f12a2de8b3efee9d8d487f752df6332c9336fccd90374d872ccceea0631ebf92

    • SSDEEP

      24576:3Mjhfa5aaH+5vgpD650+RFo6kF/5SrkGB8PGqooMWiI05bmktUNudtJjdPrF:K/nog50+Ri6kokGB9qoC1ab7SNudXjdZ

    Score
    10/10
    discoveryexecutionpovertystealerstealer

    • Detect Poverty Stealer Payload

    • Poverty Stealer

      Poverty Stealer is a crypto and infostealer written in C++.

      stealerpovertystealer

    • Povertystealer family

      povertystealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to execute payload.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks