General
-
Target
edca2f8c36f24dc6520a168a499c477ff880a0fb679bf3e08b227afb42805309
-
Size
151KB
-
Sample
220508-gz5wtacban
-
MD5
9343386c659f66a4ddf860b64cf1fc55
-
SHA1
9977986d2c647a9a51ec2a777d510d77f6006232
-
SHA256
edca2f8c36f24dc6520a168a499c477ff880a0fb679bf3e08b227afb42805309
-
SHA512
0a0a13acd2677fa5584dbc54bfe88358ffd8288002c6c23c9e3f7995d5b10c19fee588daf0df2a5030559af7c820d7a36b0f62aed6e514343769d0873256fd6b
Malware Config
Targets
-
-
Target
edca2f8c36f24dc6520a168a499c477ff880a0fb679bf3e08b227afb42805309
-
Size
151KB
-
MD5
9343386c659f66a4ddf860b64cf1fc55
-
SHA1
9977986d2c647a9a51ec2a777d510d77f6006232
-
SHA256
edca2f8c36f24dc6520a168a499c477ff880a0fb679bf3e08b227afb42805309
-
SHA512
0a0a13acd2677fa5584dbc54bfe88358ffd8288002c6c23c9e3f7995d5b10c19fee588daf0df2a5030559af7c820d7a36b0f62aed6e514343769d0873256fd6b
Score10/10-
Poullight
Poullight is an information stealer first seen in March 2020.
-
Poullight Stealer Payload
-
suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
suricata: ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php
-
suricata: ET MALWARE Matrix Max Stealer Exfiltration Observed
suricata: ET MALWARE Matrix Max Stealer Exfiltration Observed
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
suricata: ET MALWARE Win32/X-Files Stealer Activity
suricata: ET MALWARE Win32/X-Files Stealer Activity
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-