Poulight StealerMalware
- poullight
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1003.002Security Account Manager
“T1003.002 Security Account Manager”
- T1003.004LSA Secrets
“T1003.004 LSA Secrets”
- T1003.005Cached Domain Credentials
“T1003.005 Cached Domain Credentials”
- T1552.001Credentials In Files
“T1552.001 Credential in Files”
- T1552.004Private Keys
“# Private Keys & Certs & Keepass”
- T1555.003Credentials from Web Browsers
“T1555.003 Credentials from Web Browsers”
What the reports say
1 report, newest first · the exact sentence from each-
Detect Credential Access with Elastic Security“Here are detections of Chrome Login Data file access by different infostealers (Poulight Stealer, AgentTesla) including lolbins (powershell script):”
Indicators in its reports
named in the reports above- process[.]pidin 1 report
- posts.specterops[.]ioin 1 report
- 9375cff0413111d3b88a00104b2a6676in 1 report
- hxxps://github[.]com/AlessandroZ/LaZagnein 1 report
- hxxps://github[.]com/GhostPack/Seatbeltin 1 report
- hxxps://posts.specterops[.]io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107in 1 report
- hxxps://github[.]com/gtworek/PSBits/tree/master/LSASecretDumperin 1 report
- hxxps://github[.]com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.mdin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.