poullight | 34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1 | Triage

Sharing

General

Target

06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118
Size

1.1MB
Sample

240429-fxzrcabe25
MD5

06e5c0fde2cd7ee930b1049831cf8da8
SHA1

fa2350fc18cdf1f934bb8fc625578c6c38e33728
SHA256

34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1
SHA512

751868ec358664e3b167b6c48daae7b1682cc67c944adea8d1d825520877eeafa8feeefb09d7f21760f00b7073d7606bd9fcbd305d9c06f99df988802a354323
SSDEEP

24576:DS9R//SNu76MKjZ6SfLotRZj/G9L4UMt/7CRNRN0rU31H1HNAvbSyiZ:DSXaNus96ILot3OB6CX0rU3XevRiZ

Score

10^/10

poullight spyware stealer trojan

Malware Config

Targets

- Target
  
  06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  06e5c0fde2cd7ee930b1049831cf8da8
- SHA1
  
  fa2350fc18cdf1f934bb8fc625578c6c38e33728
- SHA256
  
  34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1
- SHA512
  
  751868ec358664e3b167b6c48daae7b1682cc67c944adea8d1d825520877eeafa8feeefb09d7f21760f00b7073d7606bd9fcbd305d9c06f99df988802a354323
- SSDEEP
  
  24576:DS9R//SNu76MKjZ6SfLotRZj/G9L4UMt/7CRNRN0rU31H1HNAvbSyiZ:DSXaNus96ILot3OB6CX0rU3XevRiZ
Score

10^/10

poullight spyware stealer trojan
- Poullight
  Poullight is an information stealer first seen in March 2020.
  trojan stealer poullight
- Poullight Stealer payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

poullightspywarestealertrojan

behavioral2

poullightspywarestealertrojan