BMANAGERMalware
Last reported 2 years ago, by Group-IB1 report
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1001Data Obfuscation
“T1001 – Data Obfuscation”
- T1005Data from Local System
“T1005 – Data from Local System”
- T1041Exfiltration Over C2 Channel
“T1041 – Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056 – Input Capture”
- T1056.001Keylogging
“T1056.001 – Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.007 – Command and Scripting Interpreter: JavaScript”
What the reports say
1 report, newest first · the exact sentence from each-
Boolka Unveiled: From web attacks to modular malware“… of the infrastructure used by ShadowSyndicate Group-IB Threat Intelligence analysts detected a landing page designed to distribute the BMANAGER modular trojan, created by threat actor dubbed Boolka.”
Indicators in its reports
named in the reports above- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 45.182.189[.]109in 1 report
- hxxps://beef.beonlineboo[.]com/hook.jsin 1 report
- beef.beonlineboo[.]comin 1 report
- 1-update-soft[.]comin 1 report
- update-brower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmbackup.txt;bmbackup;C:Programin 1 report
- updatebrower[.]comin 1 report
- hxxps://updatebrower[.]com/download/bmhook.txt;bmhook;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmlog.txt;bmlog;C:Programin 1 report
- hxxps://updatebrower[.]com/download/bmreader.txt;bmreader;C:Programin 1 report
- 2f10a81bc5a1aad7…bc6219ea1802in 1 report
- tacke[.]ruin 1 report
- 7266f20123edcb2e…53bff06719e4in 1 report
- 9434e2f277f764bb…68b7e9b4b3a2in 1 report
- b2dbd3187c67883c…e37f5985e367in 1 report
- 94430690ac9516a2…0b5f750685eein 1 report
- 227b8233071da4d3…23afb798375ain 1 report
- 194.165.16[.]68in 1 report
- 141.98.81[.]23in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.