Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.14314.27670.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Win32.MalwareX-gen.14314.27670.exe |
| Analysis ID: | 1467090 |
| MD5: | da4b6f39fc024d2383d4bfe7f67f1ee1 |
| SHA1: | 7cc975d9ff785e269163897907d0b9b3cee29956 |
| SHA256: | 544697a024abaea1b24eaa3d89869b2c8a4c1acf96d4e152f5632d338d054c9e |
| Tags: | exePovertyStealer |
| Infos: |  |
 | |
Detection
Poverty Stealer
| Score: | 84 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Poverty Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Abnormal high CPU Usage
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
SecuriteInfo.com.Win32.MalwareX-gen.14314.27670.exe (PID: 6500 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Malw areX-gen.1 4314.27670 .exe" MD5: DA4B6F39FC024D2383D4BFE7F67F1EE1)
- cleanup
{"C2 url": "146.70.169.164:2227"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| JoeSecurity_PovertyStealer | Yara detected Poverty Stealer | Joe Security | ||
| Click to see the 1 entries | ||||
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 0_2_038F1C94 | |
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||