New Jupyter malware steals browser data, opens backdoor

mood · Nov 13, 2020

New Jupyter malware steals browser data, opens backdoor
November 13, 2020
https://www.bleepingcomputer.com/ne...r-malware-steals-browser-data-opens-backdoor/

Russian-speaking hackers have been using a new malware to steal information from their victims. Named Jupyter, the threat has kept a low profile and benefited from a fast development cycle.

While Jupyter’s purpose is to collect data from various software, the malicious code supporting its delivery can also be used to create a backdoor on an infected system.
Installer evades detection for 6 months
A variant of the malware emerged during an incident response engagement in October at a University in the U.S. But forensic data indicates that earlier versions have been developed since May.
Click to expand...

Jupyter is .NET-based and focuses on stealing data from Chromium, Mozilla Firefox, and Google Chrome web browsers: cookies, credentials, certificates, autocomplete info.

Delivering the stealer starts with downloading an installer (Inno Setup executable) in a ZIP archive that poses as legitimate software. According to Morphisec, some of these installers went fully undetected on the VirusTotal scanning platform for the last six months.
Click to expand...

The installer leverages the process hollowing technique to inject into the memory of a process a .NET loader acting as the client for the command and control server.

“The client then downloads the next stage, a PowerShell command that executes the in-memory Jupyter .NET module,” Morphisec explains.
Morphisec’s report covers technical details for the tools and scripts used in a Jupyter attack, tracing the evolution of the components and exposing their inner workings. Indicators of compromise are also available.
Click to expand...

Morphisec: The introduction of the Jupyter InfoStealer/Backdoor

Morphisec has monitored a steady stream of forensic data to trace multiple versions of Jupyter starting in May 2020. While many of the C2s are no longer active, they consistently mapped to Russia when we were able to identify them.

This is not the only piece of evidence that this attack is likely Russian in origin. First, there is the noticeable Russian to English misspelling of the planet name. Additionally, Morphisec researchers ran a reverse Google Image search of the C2 admin panel image and were not surprised to find the exact image on Russian-language forums.
Click to expand...

Download the complete report for details on the changes and evolution of the Jupyter infostealer as well as its backdoor component.
Click to expand...

mood · Sep 22, 2021

New version of Jupyter infostealer delivered through MSI installer
Originally, Jupyter infostealer is known for stealing data from popular browsers like Chrome and Firefox
September 22, 2021
https://www.hackread.com/new-version-of-jupyter-infostealer-msi-installer/

In 2020, Hackread reported about Jupyter, a trojan discovered by cyber security researchers at Morphisec Ltd. written in .NET and served as a potent information stealer.

The trojan is designed to steal data from systems and send it to the operator’s server. This trojan generally doesn’t have long-term objectives such as gaining persistence on the system or staying there for long. Back then, the trojan mainly targeted browsers like Chrome and Mozilla Firefox.
Click to expand...

Now, Morphisec published a new report revealing that Jupyter has remained “active and highly evasive” since it was first discovered and continues to receive low-to-zero detections in the VirusTotal database. Hence, it can easily bypass detection from even the most effective solutions.
Multiple Targets Identified
On 8 September 2021, Morphisec discovered another delivery chain involving the use of Jupyter infostealer trojan. Reportedly, multiple high-level targets were identified that were the target of this trojan. This indicates threat actors are continuously developing their attack tactics to become more evasive and efficient.
Click to expand...

Morphisec: New Jupyter Evasive Delivery through MSI Installer

THE MSI PAYLOAD
In this section, we will briefly examine some of the payload`s shared attributes in order to get an overview of what indicators to expect. This is based on the six variants that we have observed.
CONCLUSION
That this attack continues to have low or no detections on VirusTotal further indicates the facility with which threat actors evade detection-based solutions. It’s clear that a new approach is required to threat prevention, as it’s likely these evasive attacks will continue.
Click to expand...

Log in or Sign up

New Jupyter malware steals browser data, opens backdoor

mood Updates Team

mood Updates Team