Overview

overview

10

Static

static

9094516c6e...b9.exe

windows7_x64

10

9094516c6e...b9.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9094516c6e0cea0e64b8a79c2f30c1408bebf705aaed7587e417445fbabd65b9

  • Size

    232KB

  • Sample

    220502-3ysezsfbbl

  • MD5

    c6c11a98c55d75f11ed88c4df931fd39

  • SHA1

    8180a64e5bb006b8485991aef1fd8cf7e105a3c6

  • SHA256

    9094516c6e0cea0e64b8a79c2f30c1408bebf705aaed7587e417445fbabd65b9

  • SHA512

    ce8a46d4e355e6a5b3e3d25de076fee1e5997e4dea3d16f729731999694039682a85ae3924713a69e435d3b39989cc5c222c62b4a4a4f4aa1ee516bd6ffaded4

Score
10/10
poullightspywarestealertrojan

Malware Config

Targets

    • Target

      9094516c6e0cea0e64b8a79c2f30c1408bebf705aaed7587e417445fbabd65b9

    • Size

      232KB

    • MD5

      c6c11a98c55d75f11ed88c4df931fd39

    • SHA1

      8180a64e5bb006b8485991aef1fd8cf7e105a3c6

    • SHA256

      9094516c6e0cea0e64b8a79c2f30c1408bebf705aaed7587e417445fbabd65b9

    • SHA512

      ce8a46d4e355e6a5b3e3d25de076fee1e5997e4dea3d16f729731999694039682a85ae3924713a69e435d3b39989cc5c222c62b4a4a4f4aa1ee516bd6ffaded4

    Score
    10/10
    poullightspywarestealertrojan

    • Poullight

      Poullight is an information stealer first seen in March 2020.

      trojanstealerpoullight

    • Poullight Stealer Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks