Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07/10/2023, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b8303120c1bf50b01dbc9f8d6fea45d8exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b8303120c1bf50b01dbc9f8d6fea45d8exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b8303120c1bf50b01dbc9f8d6fea45d8exe_JC.exe
-
Size
888KB
-
MD5
b8303120c1bf50b01dbc9f8d6fea45d8
-
SHA1
6c94bd065520ce1fb4eaac4b0479ff6087573cec
-
SHA256
c1ae35cd9be8a69a397e7b1e24229847a71bf7ff80bf4021429ee9804bf02652
-
SHA512
73b6a12703d2cc5534a3e502c79b8bb8cde78ef97daa9d6e91762ee30739c16b329fb9ff29bb6a05c4089cb1bd9ebc7c289edd5454e8f862879158686021c3d8
-
SSDEEP
12288:qIKpM6POHEEF081OMTAy/Ubf1eAUNtBI9e4fmSuBJuQpgcOmWHNtU6:qIKjPOHEEF081OMlEfUPBIpuBYHw6
Malware Config
Signatures
-
Detect Poverty Stealer Payload 6 IoCs
resource yara_rule behavioral1/memory/2292-0-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer behavioral1/memory/2292-6-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer behavioral1/memory/2292-9-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer behavioral1/memory/2292-10-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer behavioral1/memory/2292-14-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer behavioral1/memory/2292-15-0x0000000000020000-0x000000000002A000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.