General
-
Target
2025-03-31_78f026bbf3872e33c80f58b2aeb5b376_black-basta_cobalt-strike_satacom
-
Size
356KB
-
Sample
250331-tyttdawmv6
-
MD5
78f026bbf3872e33c80f58b2aeb5b376
-
SHA1
1650fd7bd7eecb5ca03bb4bca78ffb49e860eb5d
-
SHA256
9346689e8eda0f44f2d5a66b81398e8358906c879a568038756e01d1d99c1c33
-
SHA512
890c0302f21869b488cc39518855a37214b5649729c9b880e114944b8bf0c2dbac7889928ab3c493d6d04428032328f9090ef42274d1f5918abf7779a78b9202
-
SSDEEP
6144:Mrgjoi8Suh6lw+JA+ZsP3Z8sJuZWLFUosnPs++:Mi8bh6Ch+ZsPpzuZWeosn
Malware Config
Targets
-
-
Target
2025-03-31_78f026bbf3872e33c80f58b2aeb5b376_black-basta_cobalt-strike_satacom
-
Size
356KB
-
MD5
78f026bbf3872e33c80f58b2aeb5b376
-
SHA1
1650fd7bd7eecb5ca03bb4bca78ffb49e860eb5d
-
SHA256
9346689e8eda0f44f2d5a66b81398e8358906c879a568038756e01d1d99c1c33
-
SHA512
890c0302f21869b488cc39518855a37214b5649729c9b880e114944b8bf0c2dbac7889928ab3c493d6d04428032328f9090ef42274d1f5918abf7779a78b9202
-
SSDEEP
6144:Mrgjoi8Suh6lw+JA+ZsP3Z8sJuZWLFUosnPs++:Mi8bh6Ch+ZsPpzuZWeosn
Score10/10-
Detect Poverty Stealer Payload
-
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Povertystealer family
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-