Trellix Insights: BluStealer malspam campaign

Technical Articles ID: KB95191
Last Modified: 2022-09-05 09:27:38 Etc/GMT

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by Trellix Insights technology. The content is intended for use by Trellix Insights users, but is provided for general knowledge to all customers. Contact us for more information about Trellix Insights.

Summary

Description of Campaign
BluStealer contains multiple functionalities and uses malspam campaigns to spread to unsuspecting victims. The initial infection vector consists of malicious emails that contain an .iso attachment and download URLs that appear to be sent from legitimate sources. The malware performs many anti-vm checks and stops executing if any of the conditions are found. Stolen credentials, system information, browser cookies, files, screenshots, keystrokes, and clipboard data are exfiltrated using SMTP and Telegram Bot.

Our Threat Research team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Avast and shared publicly.

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check Trellix Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	9F2BFEDB157A610B8E0B481697BB28123A5EABD2DF64B814007298DFFD5E65AC
SHA256	E2DD1BE91C6DB4B52EAB38B5409B39421613DF0999176807D0A995C846465B38
SHA256	1C29EE414B011A411DB774015A98A8970BF90C3475F91F7547A16A8946CD5A81
SHA256	B340E287C5C5CD48A5D27C71808DC75C3FD3A69A6CAD029DB2332E19D998BB82
SHA256	35D443578B1EB0708D334D3E1250F68550A5DB4D630F1813FED8E2FC58A2C6D0
SHA256	7ABE87A6B675D3601A4014AC6DA84392442159A68992CE0B24E709D4A1D20690
SHA256	43C2649B8F43A3A39F3D5F93347AC0460B9CCF910BDA544E84A07769E1AF34BD
SHA256	6956EA59B4A70D68CD05E6E740598E76E1205B3E300F65C5EBA324BEBB31D7E8
SHA256	B2A74A9349ED9EBE01B89786E5472AC4CB437CEC7BFB7107E135BAA69D41E11A
SHA256	304C188B1452BEEA8B8A1F8BD4AC64B02781665792B46DF692762B18685B1CCB
SHA256	4932EA0C29C86544F03F9425B8088886D68A5965BE8541A8D9C36A9B95EEACF9
SHA256	B9DCF75696BA71F292246A31877CC8C833676C5C8C241E65C741711388D99BCB
SHA256	EFD63437050CBCE03FB4E13C4BE8858D0793CEAF678FFED8E6369578037FB6E1
SHA256	D1C69A54577F5C6491B2979279B04C5DB668E20968363D7476848D152BB94362
SHA256	B9933E298BE75DF66ED2EEE62207815A20EC36CBFAE9B098C24739F0D712AACF
SHA256	5FF29232ADCC335D007EE55421D2D6BB4AC171BECF2B9B9A7595D6E4B9FC13E1
SHA256	274BCC8A907B7F1BBFCEB5B0E9F0F8F6D0DBDC65D774CE135467B704F755DB81
SHA256	C783BDF31D6EE3782D05FDE9E87F70E9F3A9B39BF1684504770CE02F29D5B7E1
SHA256	AE29F49FA80C1A4FB2876668AA38C8262DD213FA09BF56EE6C4CAA5D52033CA1
SHA256	097D0D1119FB73B1BEB9738D7E82E1C73AB9C89A4D9B8AEED35976C76D4BAD23
SHA256	AEF52EAD2A03729F95962C511947226D78FE856D29CCFAACF25E1C002C0C9F92
SHA256	42FE72DF91AA852B257CC3227329EB5BF4FCE5DABFF34CD0093F1298E3B5454E
SHA256	5D5E9BC60284B01BC75BEC81489654B56A739D81ACCE580CDFF735070D9E831F
SHA256	6322EBB240BA18119193412E0ED7B325AF171EC9AD48F61CE532CC120418C8D5
SHA256	81BBCC887017CC47015421C38703C9C261E986C3FDCD7FEF5CA4C01BCF997007
SHA256	0872ABE29CC9231CDDED3A44E02A7EA17F09CF2AC2BDBD7077065858829C3723
SHA256	7B1FC82D47470EE3C7F8DE53A959EB55FEBE3C4C6BA408190A877396907F8293
SHA256	7603F8E827AB78D5FF15BE1B04B9A02821EDF3BF90475295E0C7C792BC328F63
SHA256	61560F470822A249950E3D35574AAE0EE9C93DA31C1FD6F001C0CEC97069A4FB

Minimum Content Versions

Content	Version
V2 DAT (VirusScan Enterprise)	10125
V3 DAT (Endpoint Security)	4582

Detection Summary

IOC	Scanner	Detection
9F2BFEDB157A610B8E0B481697BB28123A5EABD2DF64B814007298DFFD5E65AC	AVEngine V2	PWS-FCZZ!EC2B79FA4B61
	AVEngine V3	PWS-FCZZ!EC2B79FA4B61
	JTI (ATP Rules)	JTI/Suspect.196612!ec2b79fa4b61
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
E2DD1BE91C6DB4B52EAB38B5409B39421613DF0999176807D0A995C846465B38	AVEngine V2	AgentTesla-FDCV!5E630E4E830E
	AVEngine V3	AgentTesla-FDCV!5E630E4E830E
	JTI (ATP Rules)	JTI/Suspect.196612!5e630e4e830e
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
1C29EE414B011A411DB774015A98A8970BF90C3475F91F7547A16A8946CD5A81	AVEngine V2	GenericRXPX-CG!479DE94FBADD
	AVEngine V3	GenericRXPX-CG!479DE94FBADD
	JTI (ATP Rules)	JTI/Suspect.196612!479de94fbadd
	RP Static	Real Protect-PEE!479DE94FBADD
	RP Dynamic	-

IOC	Scanner	Detection
B340E287C5C5CD48A5D27C71808DC75C3FD3A69A6CAD029DB2332E19D998BB82	AVEngine V2	Agent.np
	AVEngine V3	Agent.np
	JTI (ATP Rules)	JTI/Suspect.196612!6ae510da968e
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
35D443578B1EB0708D334D3E1250F68550A5DB4D630F1813FED8E2FC58A2C6D0	AVEngine V2	GenericRXPZ-HV!6F8BB2FF1164
	AVEngine V3	GenericRXPZ-HV!6F8BB2FF1164
	JTI (ATP Rules)	JTI/Suspect.196612!6f8bb2ff1164
	RP Static	Real Protect-XGPE!6F8BB2FF1164
	RP Dynamic	-

IOC	Scanner	Detection
7ABE87A6B675D3601A4014AC6DA84392442159A68992CE0B24E709D4A1D20690	AVEngine V2	GenericRXPW-WG!6F7302E24899
	AVEngine V3	GenericRXPW-WG!6F7302E24899
	JTI (ATP Rules)	JTI/Suspect.196612!6f7302e24899
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
43C2649B8F43A3A39F3D5F93347AC0460B9CCF910BDA544E84A07769E1AF34BD	AVEngine V2	PWS-FCSU!9907B4C2E525
	AVEngine V3	PWS-FCSU!9907B4C2E525
	JTI (ATP Rules)	JTI/Suspect.196612!e0b26c5b50a3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6956EA59B4A70D68CD05E6E740598E76E1205B3E300F65C5EBA324BEBB31D7E8	AVEngine V2	AgentTesla-FDCC!EB5DBE353706
	AVEngine V3	AgentTesla-FDCC!EB5DBE353706
	JTI (ATP Rules)	JTI/Suspect.196612!e0b26c5b50a3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B2A74A9349ED9EBE01B89786E5472AC4CB437CEC7BFB7107E135BAA69D41E11A	AVEngine V2	PWS-FCSU!9907B4C2E525
	AVEngine V3	PWS-FCSU!9907B4C2E525
	JTI (ATP Rules)	JTI/Suspect.196612!9907b4c2e525
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
304C188B1452BEEA8B8A1F8BD4AC64B02781665792B46DF692762B18685B1CCB	AVEngine V2	AgentTesla-FDCV!E07778F09AA5
	AVEngine V3	AgentTesla-FDCV!E07778F09AA5
	JTI (ATP Rules)	JTI/Suspect.196612!e07778f09aa5
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
4932EA0C29C86544F03F9425B8088886D68A5965BE8541A8D9C36A9B95EEACF9	AVEngine V2	PWS-FCZF!D3439D3F2953
	AVEngine V3	PWS-FCZF!D3439D3F2953
	JTI (ATP Rules)	JTI/Suspect.196612!e0b26c5b50a3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B9DCF75696BA71F292246A31877CC8C833676C5C8C241E65C741711388D99BCB	AVEngine V2	GenericRXQJ-HP!07DDB19024BA
	AVEngine V3	GenericRXQJ-HP!07DDB19024BA
	JTI (ATP Rules)	JTI/Suspect.196612!07ddb19024ba
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EFD63437050CBCE03FB4E13C4BE8858D0793CEAF678FFED8E6369578037FB6E1	AVEngine V2	PWS-FCZZ!A14F2CF850E0
	AVEngine V3	PWS-FCZZ!A14F2CF850E0
	JTI (ATP Rules)	JTI/Suspect.196612!a14f2cf850e0
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D1C69A54577F5C6491B2979279B04C5DB668E20968363D7476848D152BB94362	AVEngine V2	Dropper-FYQ!5AD315813B75
	AVEngine V3	Dropper-FYQ!5AD315813B75
	JTI (ATP Rules)	JTI/Suspect.196612!5ad315813b75
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B9933E298BE75DF66ED2EEE62207815A20EC36CBFAE9B098C24739F0D712AACF	AVEngine V2	PWS-FCZF!03EBD4EB395C
	AVEngine V3	PWS-FCZF!03EBD4EB395C
	JTI (ATP Rules)	JTI/Suspect.196612!e0b26c5b50a3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
5FF29232ADCC335D007EE55421D2D6BB4AC171BECF2B9B9A7595D6E4B9FC13E1	AVEngine V2	GenericRXPW-WG!E1CB274E093A
	AVEngine V3	GenericRXPW-WG!E1CB274E093A
	JTI (ATP Rules)	JTI/Suspect.196612!e1cb274e093a
	RP Static	Real Protect-XGPE!E1CB274E093A
	RP Dynamic	-

IOC	Scanner	Detection
274BCC8A907B7F1BBFCEB5B0E9F0F8F6D0DBDC65D774CE135467B704F755DB81	AVEngine V2	AgentTesla-FDCE!F71BE3C684A4
	AVEngine V3	AgentTesla-FDCE!F71BE3C684A4
	JTI (ATP Rules)	JTI/Suspect.196612!f71be3c684a4
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C783BDF31D6EE3782D05FDE9E87F70E9F3A9B39BF1684504770CE02F29D5B7E1	AVEngine V2	PWS-FCXS!3729DDB118EE
	AVEngine V3	PWS-FCXS!3729DDB118EE
	JTI (ATP Rules)	JTI/Suspect.196612!3729ddb118ee
	RP Static	Real Protect-PEE!3729DDB118EE
	RP Dynamic	-

IOC	Scanner	Detection
AE29F49FA80C1A4FB2876668AA38C8262DD213FA09BF56EE6C4CAA5D52033CA1	AVEngine V2	AgentTesla-FDDB!FF4D0A47EDD5
	AVEngine V3	AgentTesla-FDDB!FF4D0A47EDD5
	JTI (ATP Rules)	JTI/Suspect.196612!ff4d0a47edd5
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
097D0D1119FB73B1BEB9738D7E82E1C73AB9C89A4D9B8AEED35976C76D4BAD23	AVEngine V2	PWS-FCZZ!D319CFD66425
	AVEngine V3	PWS-FCZZ!D319CFD66425
	JTI (ATP Rules)	JTI/Suspect.196612!92aa81a751d5
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AEF52EAD2A03729F95962C511947226D78FE856D29CCFAACF25E1C002C0C9F92	AVEngine V2	Agent.np
	AVEngine V3	Agent.np
	JTI (ATP Rules)	JTI/Suspect.196612!4b975596502b
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
42FE72DF91AA852B257CC3227329EB5BF4FCE5DABFF34CD0093F1298E3B5454E	AVEngine V2	GenericRXPT-ZJ!6FE6BA1439D8
	AVEngine V3	GenericRXPT-ZJ!6FE6BA1439D8
	JTI (ATP Rules)	JTI/Suspect.196612!6fe6ba1439d8
	RP Static	Real Protect-PEE!6FE6BA1439D8
	RP Dynamic	-

IOC	Scanner	Detection
5D5E9BC60284B01BC75BEC81489654B56A739D81ACCE580CDFF735070D9E831F	AVEngine V2	PWS-FCZZ!818D803E3BB3
	AVEngine V3	PWS-FCZZ!818D803E3BB3
	JTI (ATP Rules)	JTI/Suspect.196612!818d803e3bb3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6322EBB240BA18119193412E0ED7B325AF171EC9AD48F61CE532CC120418C8D5	AVEngine V2	GenericRXQE-VK!659ADD09FFC6
	AVEngine V3	GenericRXQE-VK!659ADD09FFC6
	JTI (ATP Rules)	JTI/Suspect.196612!e0b26c5b50a3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
81BBCC887017CC47015421C38703C9C261E986C3FDCD7FEF5CA4C01BCF997007	AVEngine V2	Agent.np
	AVEngine V3	Agent.np
	JTI (ATP Rules)	JTI/Suspect.196612!4ac6f9f4017f
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0872ABE29CC9231CDDED3A44E02A7EA17F09CF2AC2BDBD7077065858829C3723	AVEngine V2	Agent.np
	AVEngine V3	Agent.np
	JTI (ATP Rules)	JTI/Suspect.196612!91b41651e6e9
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7B1FC82D47470EE3C7F8DE53A959EB55FEBE3C4C6BA408190A877396907F8293	AVEngine V2	AgentTesla-FDCV!28896E051893
	AVEngine V3	AgentTesla-FDCV!28896E051893
	JTI (ATP Rules)	JTI/Suspect.196612!28896e051893
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7603F8E827AB78D5FF15BE1B04B9A02821EDF3BF90475295E0C7C792BC328F63	AVEngine V2	Dropper-FYQ!79A97D244336
	AVEngine V3	Dropper-FYQ!79A97D244336
	JTI (ATP Rules)	JTI/Suspect.196612!79a97d244336
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
61560F470822A249950E3D35574AAE0EE9C93DA31C1FD6F001C0CEC97069A4FB	AVEngine V2	GenericRXPU-GU!B3D0B8C065AD
	AVEngine V3	GenericRXPU-GU!B3D0B8C065AD
	JTI (ATP Rules)	JTI/Suspect.196612!b3d0b8c065ad
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

Endpoint Security - Exploit Prevention:

Rule ID: 6086 PowerShell Command Restriction - Command
Rule ID: 6135 Unmanaged PowerShell Detected

Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules:

Prevent creation of new executable files in the Windows folder
Prevent programs registering as a service

Host Intrusion Prevention:

Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 1148 CMD Tool Access by a Network Aware Application
Rule ID: 6010 Generic Application Hooking Protection

Affected Products

Trellix insights

Knowledge Center

Trellix Insights: BluStealer malspam campaign

Environment

Summary

Affected Products

Title

Title

Knowledge Center

Trellix Insights: BluStealer malspam campaign

Environment

Summary

Affected Products

Choose your region

Title

Title