New Jupyter malware steals browser data, opens backdoor

mood · Nov 13, 2020

New Jupyter malware steals browser data, opens backdoor
November 13, 2020
https://www.bleepingcomputer.com/ne...r-malware-steals-browser-data-opens-backdoor/

Russian-speaking hackers have been using a new malware to steal information from their victims. Named Jupyter, the threat has kept a low profile and benefited from a fast development cycle.

While Jupyter’s purpose is to collect data from various software, the malicious code supporting its delivery can also be used to create a backdoor on an infected system.
Installer evades detection for 6 months
A variant of the malware emerged during an incident response engagement in October at a University in the U.S. But forensic data indicates that earlier versions have been developed since May.
Click to expand...

Jupyter is .NET-based and focuses on stealing data from Chromium, Mozilla Firefox, and Google Chrome web browsers: cookies, credentials, certificates, autocomplete info.

Delivering the stealer starts with downloading an installer (Inno Setup executable) in a ZIP archive that poses as legitimate software. According to Morphisec, some of these installers went fully undetected on the VirusTotal scanning platform for the last six months.
Click to expand...

The installer leverages the process hollowing technique to inject into the memory of a process a .NET loader acting as the client for the command and control server.

“The client then downloads the next stage, a PowerShell command that executes the in-memory Jupyter .NET module,” Morphisec explains.
Morphisec’s report covers technical details for the tools and scripts used in a Jupyter attack, tracing the evolution of the components and exposing their inner workings. Indicators of compromise are also available.
Click to expand...

Morphisec: The introduction of the Jupyter InfoStealer/Backdoor

Morphisec has monitored a steady stream of forensic data to trace multiple versions of Jupyter starting in May 2020. While many of the C2s are no longer active, they consistently mapped to Russia when we were able to identify them.

This is not the only piece of evidence that this attack is likely Russian in origin. First, there is the noticeable Russian to English misspelling of the planet name. Additionally, Morphisec researchers ran a reverse Google Image search of the C2 admin panel image and were not surprised to find the exact image on Russian-language forums.
Click to expand...

Download the complete report for details on the changes and evolution of the Jupyter infostealer as well as its backdoor component.
Click to expand...

Log in or Sign up

New Jupyter malware steals browser data, opens backdoor

mood Updates Team

Log in or Sign up

New Jupyter malware steals browser data, opens backdoor

mood Updates Team

Useful Searches