povertystealer | 2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0

General

Target
2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0
Size 18KB
Sample240419-tjee5sgf24
SHA256 2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0
MD5 4c0e1720717d8d59215f12b0fd482a9f
SHA1 737fc4166dc3ac404b8296ee3bfb045c90a0bbe9
SHA512 dc982e0ac5a6ed856c321139c78ff6740d9dd8f66b54eedadd1e539b024b115cea83ed226e0772334e821f005662a475e4b4215572434e4f8d01aee9e565f559
SSDEEP 384:axR2VCFhiP0Lk5m0GF068mG/hTlUjNgKEph+gHbfPL+0XjsYF:I/FA0w40Gr8m0hV/h+gLjfTbF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
static1/unpack001/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609.exe	family_povertystealer

Povertystealer family
povertystealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609.exe

File Explorer

2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0

.zip 18KB
68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609.exe

.exe 40KB

2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0

SHA256 2f21f30a2296a79452aa817f7cc65921efe95b9d0752c7532765dc6c0ec97ae0
MD5 4c0e1720717d8d59215f12b0fd482a9f
SHA1 737fc4166dc3ac404b8296ee3bfb045c90a0bbe9
SHA512 dc982e0ac5a6ed856c321139c78ff6740d9dd8f66b54eedadd1e539b024b115cea83ed226e0772334e821f005662a475e4b4215572434e4f8d01aee9e565f559
SSDEEP 384:axR2VCFhiP0Lk5m0GF068mG/hTlUjNgKEph+gHbfPL+0XjsYF:I/FA0w40Gr8m0hV/h+gLjfTbF
MD5 SHA1 SHA512 SSDEEP

Password

infected

68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609.exe

SHA256 68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
MD5 47111001963d459c2429fccb1313d02e
SHA1 97ced198aef149b044746cacebb99e5284cf1766
SHA512 6b9ce168e4ebd2975e920a50f2321f3b576a973249c4357c8bd44ba580a408d6121005cf038666281c3add8f3d46d8eaa4c5d3e2a3f2f9d1f76422b628dc4be1
SSDEEP 384:gQcO6LvT5++oUDtp1gAPVlOxxtN99GuJkgQ82m6aCuYVbgORNp/akpZpTJH4PbHv:gXBVoGtJOFp6avYVsOZ/hBo+AJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Poverty Stealer Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing