povertystealer | tmp | Triage

Sharing

General

Target

tmp
Size

29KB
MD5

16db89328ce227006c153728c0ade1ae
SHA1

effd7c2992e64fa2d266b92054d3dee5f1e950f5
SHA256

69962181ff1d9d8f9dc80b1f91f8963aeb423f4e06f25ce3e81d22e16e1866ab
SHA512

6e1f7094d0b7b5788c8f6bf211b452d417b1ad1a0720d0fe59b3ec9d1af978d0108acb0b53a6d002245603b68e607c5297f2c01ec18fcaf6634bae02b7c26fd5
SSDEEP

384:gQcO6LvT5++oUDtp1gAPVlOxxtN99GuJkgQ82m6aCuYVbgORNp/akpZpTJH4PbHB:gXBVoGtJOFp6avYVsOZ/hBo+AJ

Score

10^/10

povertystealer

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
sample	family_povertystealer

Povertystealer family
povertystealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:5 windows x86 arch:x86

f63e2b20da57bba52ad3b39011a8e8d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
CreateMutexA
Sleep
GetLastError
CloseHandle
GetSystemInfo
CreateThread
DeleteCriticalSection
ExitProcess
GlobalMemoryStatusEx
HeapFree
GetModuleFileNameW
HeapReAlloc
IsDBCSLeadByte
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetCurrentProcess
VirtualAlloc
GetFileAttributesW
DuplicateHandle
GetModuleHandleA
OpenProcess
LoadLibraryA
GetProcAddress
IsWow64Process
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection

user32

ReleaseDC
EnumDisplayDevicesA
GetKeyboardLayoutList
GetSystemMetrics

advapi32

GetCurrentHwProfileA

crypt32

CryptProtectData

urlmon

ObtainUserAgentString

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ