BlueCore
Description
(Kaspersky) When inspecting the NewCore RAT malware delivered during the various attacks we investigated, we were able to distinguish between two variants. Both were deployed as side-loaded DLLs and shared multiple similarities, both in code and behavior. At the same time, we noticed differences that indicate the variants could have been used by different operators.
Our analysis shows that the underlying pieces of malware and the way they were used form two clusters of activity. As a result, we named the variants BlueCore and RedCore and examined the artifacts we found around each one in order to profile their related clusters.
Names
| Name |
|---|
| BlueCore |
Category
Malware
Type
- Backdoor
- Downloader
Information
Other Information
Uuid
c302b277-6326-4562-a640-8e067f7c5101
Last Card Change
2021-05-15