povertystealer | 5aa50bc32147062229a7ac6f60e15523[.]bin

General

Target

5aa50bc32147062229a7ac6f60e15523.bin
Size

18KB
MD5

925be94c4acd9b2df6cc165a20904a94
SHA1

22a21c59059405818765a280815c61b6cef87828
SHA256

67f1c0de4d8f25c0092d24f538d11c3a6ddeb4dd28348fdbc1f96394f94258d9
SHA512

71d5c400e0f8138c482c9c4c8736b8c4492e646a8c8d02c564c6736588a6759ca721a385c89afa49695e6edc3cfe68983444c239052082232f050ba05d87b670
SSDEEP

384:PSnF4/3OuK4KPQynpoz7KulUM6VfVn7rpYW7MiN5r4Fdpz3n7jV8Nr:P08+uK4KPBpon5lUMwfVPph7Mi70FdRu

Score

10^/10

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
static1/unpack001/18ec8f5f89a9410037c153399cc7e6dd49d438803f7747c201bab7d6c548f10b.bin	family_povertystealer

Povertystealer family
povertystealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/18ec8f5f89a9410037c153399cc7e6dd49d438803f7747c201bab7d6c548f10b.bin

Files

5aa50bc32147062229a7ac6f60e15523.bin
.zip

Password: infected
18ec8f5f89a9410037c153399cc7e6dd49d438803f7747c201bab7d6c548f10b.bin
.exe windows x86

Password: infected

8995d522de22f9685bfb9ecf82fc5160

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
CreateMutexA
Sleep
GetLastError
CloseHandle
GetSystemInfo
CreateThread
DeleteCriticalSection
ExitProcess
HeapFree
MultiByteToWideChar
GetModuleFileNameW
IsDBCSLeadByte
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetCurrentProcess
VirtualAlloc
GetFileAttributesW
DuplicateHandle
GetModuleHandleA
OpenProcess
LoadLibraryA
GetProcAddress
IsWow64Process
LeaveCriticalSection
HeapReAlloc
EnterCriticalSection

user32

GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
GetCursorPos
GetSystemMetrics
ReleaseDC

advapi32

GetCurrentHwProfileA

crypt32

CryptProtectData

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

8995d522de22f9685bfb9ecf82fc5160

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

crypt32

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 764B

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 764B