Overview

overview

10

Static

static

3

45aef4f9cd...04.exe

windows7-x64

10

45aef4f9cd...04.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45aef4f9cd7ecbf7080d13ffe0eaa204.exe

  • Size

    1.6MB

  • Sample

    250226-j7xlhs1ms6

  • MD5

    45aef4f9cd7ecbf7080d13ffe0eaa204

  • SHA1

    56cea58f15cbd37d8aa78d6beb5dc578ea1fdbac

  • SHA256

    fe670edde831bb8ed7cb1908c8a9d4f1fee7a782b0828f1b25855e8ddbff4cbc

  • SHA512

    367e1abdcc5032bcca0c71533a653ee87e08495fd97588b7d36c3ae28dffc52a07c753e697b1646307750bc388f5055e92a6b5ab9abbad18c89993ab60614d29

  • SSDEEP

    24576:LfCn/VJjdtaE2QvfRZNW7WDrtJgnk2M8lKndcSXI/bwsO81NKIodmM1K/Qu:LfCn/Vp6EPm7WDnnm8ndI/bwoodgQu

Score
10/10
povertystealerdefense_evasiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      45aef4f9cd7ecbf7080d13ffe0eaa204.exe

    • Size

      1.6MB

    • MD5

      45aef4f9cd7ecbf7080d13ffe0eaa204

    • SHA1

      56cea58f15cbd37d8aa78d6beb5dc578ea1fdbac

    • SHA256

      fe670edde831bb8ed7cb1908c8a9d4f1fee7a782b0828f1b25855e8ddbff4cbc

    • SHA512

      367e1abdcc5032bcca0c71533a653ee87e08495fd97588b7d36c3ae28dffc52a07c753e697b1646307750bc388f5055e92a6b5ab9abbad18c89993ab60614d29

    • SSDEEP

      24576:LfCn/VJjdtaE2QvfRZNW7WDrtJgnk2M8lKndcSXI/bwsO81NKIodmM1K/Qu:LfCn/Vp6EPm7WDnnm8ndI/bwoodgQu

    Score
    10/10
    povertystealerdefense_evasiondiscoveryspywarestealer

    • Detect Poverty Stealer Payload

    • Poverty Stealer

      Poverty Stealer is a crypto and infostealer written in C++.

      stealerpovertystealer

    • Povertystealer family

      povertystealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks