Researchers Identify New Malware Loader Variant

guest · Jun 26, 2021

Researchers Identify New Malware Loader Variant
New JSSLoader Variant is Being Spread by TA543 Group
June 26, 2021
https://www.databreachtoday.com/researchers-identify-new-malware-loader-variant-a-16944

A cybercrime group tracked as TA543 by security firm Proofpoint is deploying a new variant of a malware loader to target victims as part of a phishing campaign, the company reports.

JSSLoader was first identified by Proofpoint researchers in 2019 after it was being spread by attackers as part of an email campaign. The malware is often dropped as a first or second stage malware to target victims, however, this strain had remained inactive since May this year, the report says.
Click to expand...

With the identification of the new JSSLoader, the researchers note the strain has appeared to make a comeback with some changes, which include the malware being complied in C++ programming language.

"This version of the malware loader was rewritten from .NET to the C++ programming language," the report says. "The campaigns are ongoing and use similar lures to those initially observed by Proofpoint researchers in 2019," typically focusing on invoices and package delivery information.
Click to expand...

Latest Campaign
The TA543's campaign using the new loader began on June 8 with the attackers sending malicious phishing emails that appear to come from the United Parcel Service. The emails notified the victims that they have an undelivered parcel due to a wrong address. The links within these emails then directed the victims to a landing page that contains a Windows Scripting File hosted on SharePoint.

"If executed, it downloaded an intermediate script, which then downloaded and executed the C++ version of JSSLoader," the report says.
Click to expand...

Proofpoint: JSSLoader: Recoded and Reloaded

Key Takeaways

After a months-long absence, the malware loader JSSLoader returned in June 2021 campaigns rewritten from the .NET programming language to C++.

Rewriting the malware could be an effort by threat actors to evade current detections.

Current TA543 campaigns delivering JSSLoader are using similar lures to those observed by Proofpoint researchers in 2019 and the emails continue to contain links to a TDS landing page.

Click to expand...

Log in or Sign up

Researchers Identify New Malware Loader Variant

guest Guest

Log in or Sign up

Researchers Identify New Malware Loader Variant

guest Guest

Useful Searches