MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PovertyStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
SHA3-384 hash: fb57da2f56cb11cab413743286e3acdc8d6a97ea599d0681f9ce6c4d8ee54afe5a5752dac21045f21d04afe01b0c9fc7
SHA1 hash: 97ced198aef149b044746cacebb99e5284cf1766
MD5 hash: 47111001963d459c2429fccb1313d02e
humanhash: video-lamp-ten-paris
File name:68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
Download: download sample
Signature PovertyStealer
Create hunting rule
File size:40'960 bytes
First seen:2024-04-06 19:26:23 UTC
Last seen:2024-04-06 20:43:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 384:gQcO6LvT5++oUDtp1gAPVlOxxtN99GuJkgQ82m6aCuYVbgORNp/akpZpTJH4PbHv:gXBVoGtJOFp6avYVsOZ/hBo+AJ
TLSH T144038DA1CDE0C0B3C0630472B3AFFB9B5CFF6626022849C767B51C564996691E99B3D3
TrID 56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.1% (.EXE) Win32 Executable (generic) (4504/4/1)
3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter e24111111111111
Tags:exe PovertyStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
341
Origin country :
GR GR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609.exe
Verdict:
Suspicious activity
Analysis date:
2024-04-06 19:28:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bf10c0ee-3916-4647-861c-26075d7ecc15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Launching a process
Moving a file to the Program Files subdirectory
Replacing files
Sending an HTTP GET request
Forced system process termination
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-vm overlay packed
Link:
https://www.filescan.io/uploads/6611a207eda31927461f81d9/reports/8253afd4-57c4-4747-a936-edecdb780166/overview
Verdict:
Malicious
Labled as:
Trojan.Heur.Generic
Link:
https://www.hybrid-analysis.com/sample/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23d42da1-4aac-4dc0-95f7-77b53b0b876c
Result
Threat name:
Poverty Stealer
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1421386
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Poverty Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609/
Threat name:
Win32.Trojan.PovertyStealer
Create hunting rule
Status:
Malicious
First seen:
2024-04-06 19:27:06 UTC
File Type:
PE (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndctnxmlzrg2f32fdsn5wgsm22ldwenuh3ky3ndcwxbhatty6yeq._file
Verdict:
malicious
Result
Malware family:
povertystealer
Create hunting rule
Score:
  10/10
Tags:
family:povertystealer
Link:
https://tria.ge/reports/240406-x53xeagg3x/
Behaviour
Program crash
Unpacked files
SH256 hash:
68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609
MD5 hash:
47111001963d459c2429fccb1313d02e
SHA1 hash:
97ced198aef149b044746cacebb99e5284cf1766
Detections:
MALWARE_Win_PovertyStealer
Create hunting rule
Link:
https://www.unpac.me/results/140d7881-82c2-4218-a07b-adc6c998d150/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68c536dd8bcc4da2ef451c9bdb1a4cd6963b11b43ed58db462b5c2704e78f609

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_PovertyStealer
Create hunting rule
Author:ditekSHen
Description:Detects PovertyStealer
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Windows_Generic_Threat_deb82e8c
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments