1/6 April 2, 2021 A “txt file” can steal all your secrets blog.360totalsecurity.com/en/a-txt-file-can-steal-all-your-secrets/ Apr 2, 2021kate Tweet Learn more about 360 Total Security Recently, 360 Security Center’s threat monitoring platform has detected an email phishing attack. This attack uses a secret-stealing Trojan called Poulight. The Poulight Trojan has been put into use since last year and has complete and powerful functions. This attack proved that it has begun to spread and use overseas. Attack process analysis The attacker will first drop a phishing file using RLO (Right-to-Left Override) technology. Using RLO technology, the phishing file originally named “ReadMe_txt.lnk.lnk” will be displayed as “ReadMe_knl.txt” on the user’s computer. . At the same time, if the attacker sets the icon of the lnk file as a notepad icon, it is easy for the user to mistake it for a txt file with no harm, which is extremely confusing. In this way, the user originally thought to open a txt file, but actually executed the code prepared by the attacker. The system will execute the powershell command according to the content of the “target” customized by the attacker, download the malicious program https[:]//iwillcreatemedia[.]com/build.exe, set it as a hidden attribute, and run it. After analysis, the downloaded malicious program was compiled with .net and the internal name is Poullight.exe. The developer did not confuse the code. Code analysis Operating environment detection https://blog.360totalsecurity.com/en/a-txt-file-can-steal-all-your-secrets/?web_view=true https://twitter.com/share https://www.360totalsecurity.com/en/ https://static.ts.360.com/blog/wp-content/uploads/2021/04/1.jpg https://static.ts.360.com/blog/wp-content/uploads/2021/04/2.jpg 2/6 The putty3.exe downloaded to the local will first check whether the current environment is a virtual machine or a virus analysis environment. If it is, it will exit. This action is used to combat some sample analysis sandboxes. After passing the environmental inspection, the Trojan starts to create threads to execute its real malicious function modules. First, the Trojan will load its own resources, and Base64 decode them, and finally get the configuration content: YWRtaW4=|MQ==|MA== UG91bGlnaHQ= MHwwfDEyQ051S2tLSzF4TEZvTTlQNTh6V1hrRUxNeDF5NTF6Nll8MTJDTnVLa0tLMXhMRm9NOVA1OHpXWGtFTE14MXk1MXo2W aHR0cDovL3J1LXVpZC01MDczNTI5MjAucHAucnUvZXhhbXBsZS5leGU= PL2d4vFEgVbQddddkms0ZhQiI0I The value of is converted to lowercase and “pl2d4vfegvbqddddkms0zhqii0i” is created as the file name under the %TEMP% directory, and the written content is a random value of 8 to 32 bytes. However, analysts found that there seems to be a problem with this part of the code, or that the Trojan horse program we got is still in the pre-test stage, which makes it unable to run normally. Data theft In addition to the detection of the operating environment, the Trojan will also record user names, machine names, system names, and other machine information including installed anti-virus products, graphics card labels, and processor labels. https://static.ts.360.com/blog/wp-content/uploads/2021/04/3.jpg https://static.ts.360.com/blog/wp-content/uploads/2021/04/4.jpg 3/6 Write all the above data into the file %LocalAppData%\\<8-byte random characters>\\PC-Information.txt. It can be seen from the decompiled code that a lot of Russian descriptions are used in the program. After that, the Trojan obtains the list of currently active processes and writes it into the file %LocalAppData%\\1z9sq09u\\ProcessList.txt, which will also mark “(Injected)” after the Trojan process name. Next, get the third element in the item value of in the previously mentioned configuration file to be decoded and perform Base64 decoding again. If the value is “1”, execute the function clipper.Start(). This function will decrypt the resource named “cpp”, the connection string: 0|0|12CNuKkKK1xLFoM9P58zWXkELMx1y51z6Y|12CNuKkKK1xLFoM9P58zWXkELMx1y51z6Y|0 Write the file %TEMP%\\Windows Defender.exe and execute it (the file does not exist in the test environment). Among them, the value in is decoded by Base64 again from the value of decoded in the previous section. The following is the data stolen by Poulight and its actions: Desktop screenshot； For documents in the following folders, if the file name contains strings such as password, login, account, аккаунт, парол, вход, важно, сайта, site, or the suffix is .txt, .rtf, .log, .doc,. docx, .rdp, .sql files, all copied to the directory “\\Stealer Files\\Disks Files\\”： � Desktop directory, documents, %AppData%, %LocalAppData%； Except \Windows\, \programdata\, \program files (x86)\, \program files\, \users\, \perflogs\, \пользователи\ in the root directory of the disk; Web camera to take pictures; FileZilla server login credentials：FileZilla\recentservers.xml； Pidgin login configuration:.purple\accounts.xml； Discord data storage backup：discord\Local Storage； Telegram data storage files: Telegram Desktop\tdata\D877F783D5D3EF8C1 Telegram Desktop\tdata\D877F783D5D3EF8C0 Telegram Desktop\tdata\D877F783D5D3EF8C\\map1 Telegram Desktop\tdata\D877F783D5D3EF8C\\map0 Skype data：Microsoft\\Skype for Desktop\\Local Storage； Stealing steam ssfn authorization files； Stealing various cryptocurrency wallet related documents, including: BTC-BitCoin key data file wallet.dat, including wallet address key pair, wallet transaction and other information； BTC-Bytecoin wallet key file, search with .wallet suffix； BTC-Dash wallet wallet.dat file； All files in the storage directory of BTC-Ethereum wallet key related files under Ethereum\\keystore； BTC-Monero wallet related documents； Steal cookies, access URLs, accounts, passwords, Autofill data, payment card information, etc. of 25 browsers;The file name is searched by wildcard string: “co*es”, “log*ta”, “we*ata”, “loc*ate”, the search scope is three levels of directories starting from the browser directory: google yandex opera software amigo orbitum https://static.ts.360.com/blog/wp-content/uploads/2021/04/5.jpg 4/6 kometa maxthon torch epic browser comodo ucozmedia centbrowser go! sputnik titan browser acwebbrowser vivaldi flock srware iron sleipnir rockmelt baidu spark coolnovo blackhawk maplestudio All the stolen data is stored in the directory %LocalAppData%\\\1z9sq09u\\ (the string “1z9sq09u” is randomly generated). https://static.ts.360.com/blog/wp-content/uploads/2021/04/6.jpg 5/6 Afterwards, upload the stolen data to one of two remote C&C servers: http[:]//poullight[.]ru/handle.php (unused) http[:]//gfl.com[.]pk/Panel/gate.php. After the data is encoded, it is uploaded to the server in order. After the remote end returns the string “good”, the subsequent code will be executed. Otherwise, an upload attempt will be made every 2 seconds until it succeeds. After the above action is over, the Trojan will download the URL resource hxxp://ru-uid-507352920.pp.ru/example.exe and save it as “%LocalAppData%\\<8 bytes random characters 1>\\<8 bytes Random characters 2>.exe”, for example: %LocalAppData%\\en0mp4o4\8ej8q80s.exe. The main function of the program is also to collect various information on the machine, but after the collection, the folder where it is located is deleted. It is speculated that it is still in the testing stage. 360 Total Security already supports the detection and killing of the virus. infected User is recommended to install from the official website: https://www.360totalsecurity.com. IOCs Hash dcb4dfc4c91e5af6d6465529fefef26f 083119acb60804c6150d895d133c445a b874da17a923cf367ebb608b129579e1 C2 hxxp://gfl.com.pk/Panel/gate.php https://static.ts.360.com/blog/wp-content/uploads/2021/04/7.jpg https://static.ts.360.com/blog/wp-content/uploads/2021/04/8.jpg https://www.360totalsecurity.com/ 6/6 hxxp://poullight.ru/handle.php（Unused） URL hxxps://iwillcreatemedia.com/build.exe hxxp://ru-uid-507352920.pp.ru/example.exe Learn more about 360 Total Security https://www.360totalsecurity.com/en/