Volexity InkySquid BLUELIGHT August 2021

BLUELIGHT can collect IP information from the victim’s machine.

BLUELIGHT has a XOR-encoded payload.

BLUELIGHT can collect the username on a compromised host.

BLUELIGHT has exfiltrated data over its C2 channel.

BLUELIGHT can collect process filenames and SID authority level.

BLUELIGHT can uninstall itself.

BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.

BLUELIGHT has collected the computer name and OS version from victim machines.

BLUELIGHT can enumerate files and collect associated metadata.

BLUELIGHT can use different cloud providers for its C2.

APT37 has downloaded second stage malware from compromised websites.

BLUELIGHT can download additional files onto the host.

BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.

BLUELIGHT can collect the local time on a compromised host.

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

BLUELIGHT can check to see if the infected machine has VM tools running.

BLUELIGHT can collect a list of anti-virus products installed on a machine.

BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.

BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.

BLUELIGHT can zip files before exfiltration.

BLUELIGHT has encoded data into a binary blob using XOR.