Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. BLUELIGHT

BLUELIGHT

BLUELIGHT is a remote access Trojan used byAPT37 that was first observed in early 2021.[1]

ID: S0657
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 01 October 2021
Last Modified: 11 April 2024
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1071.001Application Layer Protocol:Web Protocols

BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.[1]

EnterpriseT1560Archive Collected Data

BLUELIGHT can zip files before exfiltration.[1]

.003Archive via Custom Method

BLUELIGHT has encoded data into a binary blob using XOR.[1]

EnterpriseT1555.003Credentials from Password Stores:Credentials from Web Browsers

BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.[1]

EnterpriseT1041Exfiltration Over C2 Channel

BLUELIGHT has exfiltrated data over its C2 channel.[1]

EnterpriseT1083File and Directory Discovery

BLUELIGHT can enumerate files and collect associated metadata.[1]

EnterpriseT1070.004Indicator Removal:File Deletion

BLUELIGHT can uninstall itself.[1]

EnterpriseT1105Ingress Tool Transfer

BLUELIGHT can download additional files onto the host.[1]

EnterpriseT1027.013Obfuscated Files or Information:Encrypted/Encoded File

BLUELIGHT has a XOR-encoded payload.[1]

EnterpriseT1057Process Discovery

BLUELIGHT can collect process filenames and SID authority level.[1]

EnterpriseT1113Screen Capture

BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.[1]

EnterpriseT1518.001Software Discovery:Security Software Discovery

BLUELIGHT can collect a list of anti-virus products installed on a machine.[1]

EnterpriseT1539Steal Web Session Cookie

BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.[1]

EnterpriseT1082System Information Discovery

BLUELIGHT has collected the computer name and OS version from victim machines.[1]

EnterpriseT1016System Network Configuration Discovery

BLUELIGHT can collect IP information from the victim’s machine.[1]

EnterpriseT1033System Owner/User Discovery

BLUELIGHT can collect the username on a compromised host.[1]

EnterpriseT1124System Time Discovery

BLUELIGHT can collect the local time on a compromised host.[1]

EnterpriseT1497.001Virtualization/Sandbox Evasion:System Checks

BLUELIGHT can check to see if the infected machine has VM tools running.[1]

EnterpriseT1102.002Web Service:Bidirectional Communication

BLUELIGHT can use different cloud providers for its C2.[1]

Groups That Use This Software

IDNameReferences
G0067APT37

[1]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp