MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PovertyStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22
SHA3-384 hash: f32f569b92e918d2c3cf79fdb4f81a6559b9d7d36d6045d90e902cc8a52a91c0fdcc32d25b0cec4f0e095f13548339c0
SHA1 hash: fc43185094768f22e4857f09cf902e4ab8b1ce57
MD5 hash: ccbba2aac1cae3a0bd29cb42203e20b4
humanhash: nevada-black-football-single
File name:file
Download: download sample
Signature PovertyStealer
Create hunting rule
File size:535'040 bytes
First seen:2023-06-27 23:57:39 UTC
Last seen:2023-06-28 02:11:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:lRdos3JPCNdsRxUxQ/tYqKFBXf1iJi3m916neS8mJOWzTKHUGetd/3U2m24:Nos5m68QlYqKdyisScKWNckzh
Threatray 84 similar samples on MalwareBazaar
TLSH T1FBB4473C1CBD2A3BC035D6B98FD5C463F554843F3922A936A8D787A44746EA225C323E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter andretavare5
Tags:exe PovertyStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc808950829_663479541?hash=K0yCWPEa4A7ApJpKzIuTMuHBaXSAot8zL0NuY18rchD&dl=LqAsNGup5PzzrdltO8f4O2XIetwWiPuj1UIdzZ97p40&api=1&no_preview=1

Intelligence

File Origin
# of uploads :
2
# of downloads :
345
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2023-06-27 23:59:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9fe9e3bb-071a-4dc0-b9c7-d0c477bd8881

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/403367/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.30347.16434.6117.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/649b778a78b782264fa0c326/reports/2c01a64a-2a0e-4f73-a407-78c600fb831d/overview
Verdict:
Malicious
Labled as:
Ser.MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/31146a2a-5b57-422c-af9d-b737c5a3ca8b
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1262365
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found API chain indicative of sandbox detection
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22/
Threat name:
ByteCode-MSIL.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-06-27 23:58:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=htmjihnhgkk7owmavdby3euqfm3ymffkxxp3hfisds6bojflzyra._file
Verdict:
malicious
Similar samples:
18b6a73808a0524c95b724475d46aca3e42874de551a0fcf7c8d56aff23f105b
PovertyStealer
2f8e9facdf104aa0a763dd40689e81b21b6664fb3b737e8d391d111e2bb38087
PovertyStealer
397046da411436841b9eee2f3edc21f72ba89f0165a29e1fef0cafa6755fcdb0
PovertyStealer
4400353ebbbd72f1a260b3021c48fa67439ec6accd01ecd27ada202052f27391
PovertyStealer
5527c6e95c67b38151fbbf6f5d18671d56c96f27f66981029c633a413e73d7b0
PovertyStealer
7acc949f4e01f5ee720f2821349e3a0dcf05a7ac15470a8d7f6ff9aef1d00d2e
PovertyStealer
7e7f1d18321207cbaabea3f8c316d13c13dbfae51a52a42c5a9d3c5478f75454
PovertyStealer
c155fef955e84c3105693dd142f5e385ee89fa251fd071f366dc6caa94a34502
PovertyStealer
e2ceee53e039eaca503c58bd2be1b268bfbc1f17a7568e70bdedf5ca8d1bd637
PovertyStealer
+ 74 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230627-3z5rpsgg4y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
96d13bafb45b1d00d50453359d27a90da2437aa3d93cc7a1ca94d6d1c53f85de
MD5 hash:
f5ba027dce24a30a7730f68fc23eef6d
SHA1 hash:
e7b4811795f8594b037e8d1a783d67e388986256
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
0555b03504ea99eb59540141c82f44d3e5c43d95c62f18e8fbbe88cb91bba9d0
MD5 hash:
f9fd509be574b3781ed0b971dcedf8e9
SHA1 hash:
7a99866c507908edec1156f33ccf09717e16d77d
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
96d13bafb45b1d00d50453359d27a90da2437aa3d93cc7a1ca94d6d1c53f85de
MD5 hash:
f5ba027dce24a30a7730f68fc23eef6d
SHA1 hash:
e7b4811795f8594b037e8d1a783d67e388986256
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
0555b03504ea99eb59540141c82f44d3e5c43d95c62f18e8fbbe88cb91bba9d0
MD5 hash:
f9fd509be574b3781ed0b971dcedf8e9
SHA1 hash:
7a99866c507908edec1156f33ccf09717e16d77d
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
96d13bafb45b1d00d50453359d27a90da2437aa3d93cc7a1ca94d6d1c53f85de
MD5 hash:
f5ba027dce24a30a7730f68fc23eef6d
SHA1 hash:
e7b4811795f8594b037e8d1a783d67e388986256
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
0555b03504ea99eb59540141c82f44d3e5c43d95c62f18e8fbbe88cb91bba9d0
MD5 hash:
f9fd509be574b3781ed0b971dcedf8e9
SHA1 hash:
7a99866c507908edec1156f33ccf09717e16d77d
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
96d13bafb45b1d00d50453359d27a90da2437aa3d93cc7a1ca94d6d1c53f85de
MD5 hash:
f5ba027dce24a30a7730f68fc23eef6d
SHA1 hash:
e7b4811795f8594b037e8d1a783d67e388986256
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
0555b03504ea99eb59540141c82f44d3e5c43d95c62f18e8fbbe88cb91bba9d0
MD5 hash:
f9fd509be574b3781ed0b971dcedf8e9
SHA1 hash:
7a99866c507908edec1156f33ccf09717e16d77d
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
867c70bd4fb8c0b35a98109c398d54c47d3042dca3e91fad56a4449fca9bbec3
MD5 hash:
ddc8615f9751995ed3950b1ca6977412
SHA1 hash:
62350c8523f0ff5cda8979330237c66c19d27c74
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
SH256 hash:
3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22
MD5 hash:
ccbba2aac1cae3a0bd29cb42203e20b4
SHA1 hash:
fc43185094768f22e4857f09cf902e4ab8b1ce57
Link:
https://www.unpac.me/results/1d2a09aa-aa10-4e2a-8d75-c5335233e996/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3cd8941da732/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/403367/

Comments