povertystealer | 709d4a2c6b1307768277cbcafa383579d5ef81eeb0845532a1f1b01168e6ea10[.]exe

General

Target

709d4a2c6b1307768277cbcafa383579d5ef81eeb0845532a1f1b01168e6ea10.exe
Size

29KB
MD5

472277a6072a8cfa733117ff1597c8da
SHA1

83e570c6eca17446ac0b8418f11fa25b9c5c10a7
SHA256

709d4a2c6b1307768277cbcafa383579d5ef81eeb0845532a1f1b01168e6ea10
SHA512

de7c9fce7211a5628c3793df5632835f3c5588949549504243cc90182fb754cb09961ef303c6b0e77124ae04a231e7a7207c8eb966f868144c249104215467fe
SSDEEP

384:piY/4mcwYPSNOjKjg11+rVlOxxtNP97kJkgQ8pwIIumVbgORBprjlJZpTJ3uPbH0:piWWjjKjrOFgwItmVsOlr1B+90H

Score

10^/10

povertystealer

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

Processes:

resource	yara_rule
sample	family_povertystealer

Povertystealer family
povertystealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
709d4a2c6b1307768277cbcafa383579d5ef81eeb0845532a1f1b01168e6ea10.exe

Files

709d4a2c6b1307768277cbcafa383579d5ef81eeb0845532a1f1b01168e6ea10.exe
.exe windows:5 windows x86 arch:x86

f63e2b20da57bba52ad3b39011a8e8d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
CreateMutexA
Sleep
GetLastError
CloseHandle
GetSystemInfo
CreateThread
DeleteCriticalSection
ExitProcess
GlobalMemoryStatusEx
HeapFree
GetModuleFileNameW
HeapReAlloc
IsDBCSLeadByte
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetCurrentProcess
VirtualAlloc
GetFileAttributesW
DuplicateHandle
GetModuleHandleA
OpenProcess
LoadLibraryA
GetProcAddress
IsWow64Process
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection

user32

ReleaseDC
EnumDisplayDevicesA
GetKeyboardLayoutList
GetSystemMetrics

advapi32

GetCurrentHwProfileA

crypt32

CryptProtectData

urlmon

ObtainUserAgentString

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f63e2b20da57bba52ad3b39011a8e8d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

crypt32

urlmon

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 764B

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 764B