360 Total Security Blog

A “txt file” can steal all your secrets

  • kate

    • Recently, 360 Security Center’s threat monitoring platform has detected an email phishing attack. This attack uses a secret-stealing Trojan called Poulight. The Poulight Trojan has been put into use since last year and has complete and powerful functions. This attack proved that it has begun to spread and use overseas.

    Attack process analysis

    The attacker will first drop a phishing file using RLO (Right-to-Left Override) technology. Using RLO technology, the phishing file originally named “ReadMe_txt.lnk.lnk” will be displayed as “ReadMe_knl.txt” on the user’s computer. . At the same time, if the attacker sets the icon of the lnk file as a notepad icon, it is easy for the user to mistake it for a txt file with no harm, which is extremely confusing.

    In this way, the user originally thought to open a txt file, but actually executed the code prepared by the attacker. The system will execute the powershell command according to the content of the “target” customized by the attacker, download the malicious program https[:]//iwillcreatemedia[.]com/build.exe, set it as a hidden attribute, and run it.

    After analysis, the downloaded malicious program was compiled with .net and the internal name is Poullight.exe. The developer did not confuse the code.

    Code analysis

    Operating environment detection

    The putty3.exe downloaded to the local will first check whether the current environment is a virtual machine or a virus analysis environment. If it is, it will exit. This action is used to combat some sample analysis sandboxes.

    After passing the environmental inspection, the Trojan starts to create threads to execute its real malicious function modules.

    First, the Trojan will load its own resources, and Base64 decode them, and finally get the configuration content:

    <prog.params>YWRtaW4=|MQ==|MA==</prog.params>

    <title>UG91bGlnaHQ=</title>

    <cpdata>MHwwfDEyQ051S2tLSzF4TEZvTTlQNTh6V1hrRUxNeDF5NTF6Nll8MTJDTnVLa0tLMXhMRm9NOVA1OHpXWGtFTE14MXk1MXo2WXww</cpdata>

    <ulfile>aHR0cDovL3J1LXVpZC01MDczNTI5MjAucHAucnUvZXhhbXBsZS5leGU=</ulfile>

    <mutex>PL2d4vFEgVbQddddkms0ZhQiI0I</mutex>

    The value of <mutex> is converted to lowercase and “pl2d4vfegvbqddddkms0zhqii0i” is created as the file name under the %TEMP% directory, and the written content is a random value of 8 to 32 bytes. However, analysts found that there seems to be a problem with this part of the code, or that the Trojan horse program we got is still in the pre-test stage, which makes it unable to run normally.

    Data theft

    In addition to the detection of the operating environment, the Trojan will also record user names, machine names, system names, and other machine information including installed anti-virus products, graphics card labels, and processor labels.

    Write all the above data into the file %LocalAppData%\\<8-byte random characters>\\PC-Information.txt. It can be seen from the decompiled code that a lot of Russian descriptions are used in the program.

    After that, the Trojan obtains the list of currently active processes and writes it into the file %LocalAppData%\\1z9sq09u\\ProcessList.txt, which will also mark “(Injected)” after the Trojan process name.

    Next, get the third element in the item value of <prog.params> in the previously mentioned configuration file to be decoded and perform Base64 decoding again. If the value is “1”, execute the function clipper.Start(). This function will decrypt the resource named “cpp”, the connection string:

    <clbase>0|0|12CNuKkKK1xLFoM9P58zWXkELMx1y51z6Y|12CNuKkKK1xLFoM9P58zWXkELMx1y51z6Y|0</clbase>

    Write the file %TEMP%\\Windows Defender.exe and execute it (the file does not exist in the test environment). Among them, the value in <clbase> is decoded by Base64 again from the value of <cpdata> decoded in the previous section.

    The following is the data stolen by Poulight and its actions:

    google

    yandex

    opera software

    amigo

    orbitum

    kometa

    maxthon

    torch

    epic browser

    comodo

    ucozmedia

    centbrowser

    go!

    sputnik

    titan browser

    acwebbrowser

    vivaldi

    flock

    srware iron

    sleipnir

    rockmelt

    baidu spark

    coolnovo

    blackhawk

    maplestudio

    All the stolen data is stored in the directory %LocalAppData%\\\1z9sq09u\\ (the string “1z9sq09u” is randomly generated).

    Afterwards, upload the stolen data to one of two remote C&C servers:

    http[:]//poullight[.]ru/handle.php (unused)

    http[:]//gfl.com[.]pk/Panel/gate.php.

    After the data is encoded, it is uploaded to the server in order. After the remote end returns the string “good”, the subsequent code will be executed. Otherwise, an upload attempt will be made every 2 seconds until it succeeds.

    After the above action is over, the Trojan will download the URL resource hxxp://ru-uid-507352920.pp.ru/example.exe and save it as “%LocalAppData%\\<8 bytes random characters 1>\\<8 bytes Random characters 2>.exe”, for example: %LocalAppData%\\en0mp4o4\8ej8q80s.exe.

    The main function of the program is also to collect various information on the machine, but after the collection, the folder where it is located is deleted. It is speculated that it is still in the testing stage.

    360 Total Security already supports the detection and killing of the virus. infected User is recommended to install from the official website: https://www.360totalsecurity.com.

    IOCs

    Hash

    dcb4dfc4c91e5af6d6465529fefef26f

    083119acb60804c6150d895d133c445a

    b874da17a923cf367ebb608b129579e1

    C2

    hxxp://gfl.com.pk/Panel/gate.php

    hxxp://poullight.ru/handle.php（Unused）

    URL

    hxxps://iwillcreatemedia.com/build.exe

    hxxp://ru-uid-507352920.pp.ru/example.exe