Malware News New Jupyter Infostealer Version Emerges with Sophisticated Stealth Tactics

[silversurfer]

Content source

https://thehackernews.com/2023/11/new-jupyter-infostealer-version-emerges.html

An updated version of an information stealer malware known as Jupyter has resurfaced with "simple yet impactful changes" that aim to stealthily establish a persistent foothold on compromised systems.

"The team has discovered new waves of Jupyter Infostealer attacks which leverage PowerShell command modifications and signatures of private keys in attempts to pass off the malware as a legitimately signed file," VMware Carbon Black researchers said in a report shared with The Hacker News.

The latest set of artifacts uses various certificates to sign the malware to lend them a veneer of legitimacy, only for the fake installers to activate the infection chain upon launch.
The installers are designed to invoke an interim payload that, in turn, employs PowerShell to connect to a remote server and ultimately decode and launch the stealer malware.

 

[Andy Ful]

PowerShell mostly blocks such attacks in Constrained Language Mode (CLM).
In this example, the malware connects with C2 server by using the methods blocked by CLM:
[Text.Encoding]::UTF8.GetString()
[IO.File]::ReadAllBytes()

Next, the malware decodes the Infostealer payload (from .dat file) by using other methods blocked by CLM:
[Convert]::FromBase64String()
New-Object System.Security.Cryptography.AesCryptoServiceProvider

Finally, it loads the DLL payload in-memory (Infostealer) by using another method blocked by CLM
[Reflection.Assembly]::Load()

Edit.
One can confirm that CLM blocks these methods by executing them in the PowerShell console. The execution will end with error:
"Cannot invoke method. Method invocation is supported only on core types in this language mode."

 

[Andy Ful]

Another example of using PowerShell in the attack started by the initial EXE/MSI files is LummaC2 stealer analyzed also by VMware Carbon Black (in October 2023):

https://blogs.vmware.com/security/2023/10/an-ilummanation-on-lummastealer.html

It uses another set of popular methods (blocked by Constrained Language Mode) to download a payload:
[Net.Webrequest]::Create()
New-Object Net.WebClient

Edit.
As in the previous article about Jupyter Infostealer, the authors from VMware Security Blog claim that Carbon Black can be efficient for the detection, prevention, and containment of such malware. We should take it with a grain of salt. Other AVs can use similar ATP methods. For example, Bitdefender can often block the PowerShell process spawned by an EXE file.

 

[Andy Ful]

Another fresh example:

Malware News - New GootLoader Malware Variant Evades Detection and Spreads Rapidly

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using...

malwaretips.com

GootBot - Gootloader's new approach to post-exploitation

IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant. Learn more about this and how to combat it.

securityintelligence.com

In this article, the GootBot payload uses a PowerShell script with methods blocked by CLM:
[Convert]::FromBase64String()
[Scriptblock]:: ("create")()