General

  • Target

    PoorChecker 2.7V.rar

  • Size

    27.3MB

  • MD5

    b953de35b7b2f8437c0ab6a5caaa77e7

  • SHA1

    a87d7c8dfcca9edf95901a7d82f8d6e561b37145

  • SHA256

    36d76bec8aab1199c777bc14e10a0cf02411d3eefe1116c8a7b6a6aef6a2678c

  • SHA512

    a901d3d9897777830c60de63055e40e1e7e60b64390d5f3dddf2ac4bf7747a644c3fd253bd52ba60e0ed69f88b84351db87a163a427e70752330075dcb16a982

  • SSDEEP

    786432:hANzjbwx2YTFeTcFz1dZk1/OZlaMGnsPc7Wlq:KNz3Q2GFgcFzzZ6zMLLs

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • PoorChecker 2.7V.rar
    .rar
  • PoorChecker 2.7V/Database/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    8235041cfd6fffb926142c2c78013446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/Database/ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    14338d2168d869b1b53d66354179e8c5


    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/Database/icudtl.dat
  • PoorChecker 2.7V/Database/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/Database/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    7e67cb770e0040254310165a1b309202


    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/Database/v8_context_snapshot.bin
  • PoorChecker 2.7V/Database/vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    c6d5499631d983c25f3393a4b4b13399


    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/Database/vk_swiftshader_icd.json
  • PoorChecker 2.7V/Database/vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    49ed29c3ff417b26c7cd92ecc9b7dcb3


    Headers

    Imports

    Exports

    Sections

  • PoorChecker 2.7V/PoorChecker.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • �4�$���.pyc
  • PoorChecker 2.7V/locales/af.pak
  • PoorChecker 2.7V/locales/am.pak
  • PoorChecker 2.7V/locales/ar.pak
  • PoorChecker 2.7V/locales/bg.pak
  • PoorChecker 2.7V/locales/bn.pak
  • PoorChecker 2.7V/locales/ca.pak
  • PoorChecker 2.7V/locales/cs.pak
  • PoorChecker 2.7V/locales/da.pak
  • PoorChecker 2.7V/locales/de.pak
  • PoorChecker 2.7V/locales/el.pak
  • PoorChecker 2.7V/locales/en-GB.pak
  • PoorChecker 2.7V/locales/en-US.pak
  • PoorChecker 2.7V/locales/es-419.pak
  • PoorChecker 2.7V/locales/es.pak
  • PoorChecker 2.7V/locales/et.pak
  • PoorChecker 2.7V/locales/fa.pak
  • PoorChecker 2.7V/locales/fi.pak
  • PoorChecker 2.7V/locales/fil.pak
  • PoorChecker 2.7V/locales/fr.pak
  • PoorChecker 2.7V/locales/gu.pak
  • PoorChecker 2.7V/locales/he.pak
  • PoorChecker 2.7V/locales/hi.pak
  • PoorChecker 2.7V/locales/hr.pak
  • PoorChecker 2.7V/locales/hu.pak
  • PoorChecker 2.7V/locales/id.pak
  • PoorChecker 2.7V/locales/it.pak
  • PoorChecker 2.7V/locales/ja.pak
  • PoorChecker 2.7V/locales/kn.pak
  • PoorChecker 2.7V/locales/ko.pak
  • PoorChecker 2.7V/locales/lt.pak
  • PoorChecker 2.7V/locales/lv.pak
  • PoorChecker 2.7V/locales/ml.pak
  • PoorChecker 2.7V/locales/mr.pak
  • PoorChecker 2.7V/locales/ms.pak
  • PoorChecker 2.7V/locales/nb.pak
  • PoorChecker 2.7V/locales/nl.pak
  • PoorChecker 2.7V/locales/pl.pak
  • PoorChecker 2.7V/locales/pt-BR.pak
  • PoorChecker 2.7V/locales/pt-PT.pak
  • PoorChecker 2.7V/locales/ro.pak
  • PoorChecker 2.7V/locales/ru.pak
  • PoorChecker 2.7V/locales/sk.pak
  • PoorChecker 2.7V/locales/sl.pak
  • PoorChecker 2.7V/locales/sr.pak
  • PoorChecker 2.7V/locales/sv.pak
  • PoorChecker 2.7V/locales/sw.pak
  • PoorChecker 2.7V/locales/ta.pak
  • PoorChecker 2.7V/locales/te.pak
  • PoorChecker 2.7V/locales/th.pak
  • PoorChecker 2.7V/locales/tr.pak
  • PoorChecker 2.7V/locales/uk.pak
  • PoorChecker 2.7V/locales/ur.pak
  • PoorChecker 2.7V/locales/vi.pak
  • PoorChecker 2.7V/locales/zh-CN.pak
  • PoorChecker 2.7V/locales/zh-TW.pak
  • PoorChecker 2.7V/resources/app.asar
  • PoorChecker 2.7V/resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections