povertystealer | tmp

General

Target
tmp
Size 29KB
Sample240304-h1c3vsdf57
SHA256 69962181ff1d9d8f9dc80b1f91f8963aeb423f4e06f25ce3e81d22e16e1866ab
MD5 16db89328ce227006c153728c0ade1ae
SHA1 effd7c2992e64fa2d266b92054d3dee5f1e950f5
SHA512 6e1f7094d0b7b5788c8f6bf211b452d417b1ad1a0720d0fe59b3ec9d1af978d0108acb0b53a6d002245603b68e607c5297f2c01ec18fcaf6634bae02b7c26fd5
SSDEEP 384:gQcO6LvT5++oUDtp1gAPVlOxxtN99GuJkgQ82m6aCuYVbgORNp/akpZpTJH4PbHB:gXBVoGtJOFp6avYVsOZ/hBo+AJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
sample	family_povertystealer

Povertystealer family
povertystealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

File Explorer

tmp

.exe 29KB

tmp

IMPHASH f63e2b20da57bba52ad3b39011a8e8d2
SHA256 69962181ff1d9d8f9dc80b1f91f8963aeb423f4e06f25ce3e81d22e16e1866ab
MD5 16db89328ce227006c153728c0ade1ae
SHA1 effd7c2992e64fa2d266b92054d3dee5f1e950f5
SHA512 6e1f7094d0b7b5788c8f6bf211b452d417b1ad1a0720d0fe59b3ec9d1af978d0108acb0b53a6d002245603b68e607c5297f2c01ec18fcaf6634bae02b7c26fd5
SSDEEP 384:gQcO6LvT5++oUDtp1gAPVlOxxtN99GuJkgQ82m6aCuYVbgORNp/akpZpTJH4PbHB:gXBVoGtJOFp6avYVsOZ/hBo+AJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Poverty Stealer Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

tmp

kernel32

user32

advapi32

crypt32

urlmon

generic

Sharing