Jupyter

The primary infection vector of SolarMarker is SEO poisoning, which is an attack method in which threat actors create malicious websites packed with keywords and use search engine optimization techniques to make them show up prominently in search results.

this campaign lays long-standing traps for victims using Google search redirection and the drive-by-download method.

By using this tool, threat actors gain access to the easy implementation of obscured script executions.

TRU has observed SolarMarker executing similar PowerShell commands... SolarMarker attempts to load the Jupyter PowerShell loader from the – scriptFile parameter.

The infection process relies on exploiting the user, not an application. The user simply executes a binary disguised as a PDF to infect the machine.

Create_Registry_Key -reg_path (“<REG_PATH”) -execution_command ('Powershell -WindowStyle Hidden -ep Bypass -Command " + $decode_and_execute_payload_script'); ... $lnk_object = New-Object -ComObject WScript.Shell.CreateShortcut($ENV:APPDATA + '<Startup_Lnk_Path');

$lnk_object = New-Object -ComObject WScript.Shell.CreateShortcut($ENV:APPDATA + '<Startup_Lnk_Path'); $lnk_object.TargetPath = $payload_directory_path + '\' + $random_path_str; $lnk_object.WindowStyle = 7; $lnk_object.Save();

These include: ... hollowing shellcode into legitimate windows configuration applications.

Create_Registry_Key -reg_path (“<REG_PATH”) -execution_command ('Powershell -WindowStyle Hidden -ep Bypass -Command " + $decode_and_execute_payload_script'); ... $lnk_object = New-Object -ComObject WScript.Shell.CreateShortcut($ENV:APPDATA + '<Startup_Lnk_Path');

$lnk_object = New-Object -ComObject WScript.Shell.CreateShortcut($ENV:APPDATA + '<Startup_Lnk_Path'); $lnk_object.TargetPath = $payload_directory_path + '\' + $random_path_str; $lnk_object.WindowStyle = 7; $lnk_object.Save();

This allows the payload to thwart online AV scanners... the Jupyter PowerShell loader... keeps a very evasive file with low to 0 detections on VirusTotal... all of the .NET DLL Payloads should be obfuscated.

the executable disguised as a pdf document or a word document

These include: ... hollowing shellcode into legitimate windows configuration applications.

The initial suspicious indicator visible in the dynamic analysis is the PowerShell command-line spawned by msiexec.exe.

The resulting binary blob is then decoded by XORing its byte array with a hardcoded key and injected into memory through reflective assembly loading.

Two of the variants are signed with a (currently) valid certificate named ‘TACHOPARTS SP Z O O’... Another variant was signed with a revoked certificate named ‘OOO Sistema’.

With the browser data loaded, threat actors can access accounts to perform financial fraud and data theft.

All of these actions were performed from the victim device and were made possible due to credentials stored by the browser and by accounts that were logged in at the time of access.

Jupyter’s attack chain typically starts with a downloaded zip file that contains an installer

The actor now uses a 16 byte, randomly generated AES symmetric key to encrypt the data sent to and from the C2 host... This key is sent with the victim identification string back to the actor's C2 in the first HTTP request, which is itself encrypted using an RSA asymmetric key pair.

These include: a C2 client download and execute malware execution of PowerShell scripts and commands

once SolarMarker is active, the threat actors can send commands and upload additional files to the infected system.

Gh0st is dropped by other malware to create a backdoor into a device that allows an attacker to fully control the infected device.

Agent Tesla is a RAT that exfiltrate credentials, log keystrokes, and capture screenshots from an infected computer.