BLUELIGHT
Description
(Volexity) The BLUELIGHT malware family uses different cloud providers to facilitate C2. This specific sample leveraged the Microsoft Graph API for its C2 operations. Upon start-up, BLUELIGHT performs an oauth2 token authentication using hard-coded parameters. Once the client is authenticated, BLUELIGHT creates a new subdirectory in the OneDrive appfolder and populates it with several subdirectories used by the C2 protocol.
Names
| Name |
|---|
| BLUELIGHT |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Info stealer
- Credential stealer
- Downloader
- Exfiltration
Information
Mitre Attack
Malpedia
Other Information
Uuid
ed4fb152-2560-48d0-aea4-aee2e43ff69f
Last Card Change
2023-10-13