Tuesday, July 16, 2024

Hackers Using BlueShell Malware to Attack Windows, Linux, and Mac Systems

The usage of Blueshell malware spikes up by various threat actors to target Windows, Linux, and other operating systems across Korea and Thailand.

Blueshell backdoor malware has been active since 2020 and written in GO language, believed to be created by a Chinese user, which is available on the GitHub repository.

Though the original GitHub repository was deleted, BlueShell’s source code can still be accessed from other repositories. 

AhnLab Security Emergency Response Center (ASEC) monitors APT attack cases using BlueShell and has released the summarized report of APT attack cases using BlueShell.

Considering the functionality of the Backshell, it is designed and uses TLS encryption to circumvent network detection with the C&C server. 

The Remote command execution, file download/upload, and Socks5 proxy were executed by the attacker through commands.

Blueshell Malware Config

BlueShell has three configuration data: the C&C server’s IP address, port number, and waiting time. 

The research revealed the usage of blue shell malware by Dalbit Group during the attack against the Windows platform.

The Dalbit Group is a China-based threat group that mostly targets vulnerable servers to steal information containing critical data to demand money.

“While ASEC was monitoring BlueShell targeting the Linux environment, it identified a customized form of BlueShell from VirusTotal.”

The attacker first created Dropper malware and used it to install BlueShell, which is responsible for creating and executing BlueShell like a regular dropper.

But the main difference is that it sets and executes an environment variable named “lgdt” when running. 

The generated BlueShell obtains the “lgdt” environment variable, decrypts it, and uses it as the C&C server address. Accordingly, BlueShell alone cannot verify the address of the C&C server.

Indicator of compromise

– 53271b2ab6c327a68e78a7c0bf9f4044 
– 011cedd9932207ee5539895e2a1ed60a 
– 31c4a3f16baa5e0437fdd4603987b812
– 9f55b31c66a01953c17eea6ace66f636
– 33129e959221bf9d5211710747fddabe
– 96ec8798bba011d5be952e0e6398795d 
– b434df66d0dd15c2f5e5b2975f2cfbe2 
– f4ace89337c8448f13d6eb538a79ce30 
– 5e0845a9f08c1cfc7966824758b6953a
– e981219f6ba673e977c5c1771f86b189
– 85a6e4448f4e5be1aa135861a2c35d35
– 1a0c704611395b53f632d4f6119ed20c
– 4eb724cc5f3d94510ba5fc8d4dba6bb6
– 47fc0ecb87c1296b860b2e10d119fc6c 
– 2ed0a868520c31e27e69a0ab1a4e6 90d
– 3f022d65129238c2d34e41deba3e24d3 
– 30fe6a0ba1d77e05a19d87fcf99e7ca5

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles