Overview

overview

10

Static

static

1

sansayrex.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sansayrex.rar

  • Size

    2.7MB

  • Sample

    250331-t31gqawm14

  • MD5

    ab3fc014b70ca478c3d69087822bd477

  • SHA1

    7af220ee31e5c62b7594f708b5db767cfc636577

  • SHA256

    7741cd9265cbb2052bfa489dc62a467b00362e720632c3d620ea939da7d756ce

  • SHA512

    c3757cda1eabb927a19c3e69cc5783e179a1ad1b6b8ce878a1738f69f695dc3a15002e64993d9b87a11cb6e0fb77a7887c5d4e14286c0f642107fb49613f2e92

  • SSDEEP

    49152:58STJCYouFTPJo/3tPo6PXc7cntnFqxxDTUK/f2hKt87ip1Rrf3lsVma463EHqPL:51Tvfo/3twFcDqXf5/87A3lK3EKPgm35

Score
10/10
povertystealerdiscoverystealer

Malware Config

Targets

    • Target

      sansayrex.rar

    • Size

      2.7MB

    • MD5

      ab3fc014b70ca478c3d69087822bd477

    • SHA1

      7af220ee31e5c62b7594f708b5db767cfc636577

    • SHA256

      7741cd9265cbb2052bfa489dc62a467b00362e720632c3d620ea939da7d756ce

    • SHA512

      c3757cda1eabb927a19c3e69cc5783e179a1ad1b6b8ce878a1738f69f695dc3a15002e64993d9b87a11cb6e0fb77a7887c5d4e14286c0f642107fb49613f2e92

    • SSDEEP

      49152:58STJCYouFTPJo/3tPo6PXc7cntnFqxxDTUK/f2hKt87ip1Rrf3lsVma463EHqPL:51Tvfo/3twFcDqXf5/87A3lK3EKPgm35

    Score
    10/10
    povertystealerdiscoverystealer

    • Detect Poverty Stealer Payload

    • Poverty Stealer

      Poverty Stealer is a crypto and infostealer written in C++.

      stealerpovertystealer

    • Povertystealer family

      povertystealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks