Overview

overview

10

Static

static

1fa095732c...92.exe

windows7_x64

10

1fa095732c...92.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fa095732c97b5ed364f985d412e083b6e9b213ca5487f03c5c0e70e07b59692

  • Size

    4.8MB

  • Sample

    220330-j5jlwaefgk

  • MD5

    dce2367e077d94b44f4ba332300820a9

  • SHA1

    d901f88c286eb4c46bd995a8c08c415ec7d5eb93

  • SHA256

    1fa095732c97b5ed364f985d412e083b6e9b213ca5487f03c5c0e70e07b59692

  • SHA512

    a094ae52cf55dace4da04b68225fabb949d8533ae94f6412798367ee1ad59e5ed90e9b20fc16cb749855d7b9d8a66affbef24c4477e6a0bda7aef1f279a5fbcb

Score
10/10
poullightpersistencespywarestealersuricatatrojan

Malware Config

Targets

    • Target

      1fa095732c97b5ed364f985d412e083b6e9b213ca5487f03c5c0e70e07b59692

    • Size

      4.8MB

    • MD5

      dce2367e077d94b44f4ba332300820a9

    • SHA1

      d901f88c286eb4c46bd995a8c08c415ec7d5eb93

    • SHA256

      1fa095732c97b5ed364f985d412e083b6e9b213ca5487f03c5c0e70e07b59692

    • SHA512

      a094ae52cf55dace4da04b68225fabb949d8533ae94f6412798367ee1ad59e5ed90e9b20fc16cb749855d7b9d8a66affbef24c4477e6a0bda7aef1f279a5fbcb

    Score
    10/10
    poullightpersistencespywarestealersuricatatrojan

    • Poullight

      Poullight is an information stealer first seen in March 2020.

      trojanstealerpoullight

    • Poullight Stealer Payload

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks