A New Jupyter Malware Version is Being Distributed via MSI Installers

Cybersecurity researchers have charted the evolution of Jupyter,
a .NET infostealer known for singling out healthcare and education
sectors, which make it exceptional at defeating most endpoint
security scanning solutions.

The new delivery chain, spotted by Morphisec^[1]
on September 8, underscores that the malware has not just continued
to remain active but also showcases “how threat actors continue to
develop their attacks to become more efficient and evasive.” The
Israeli company said it’s currently investigating the scale and
scope of the attacks.

First documented^[2]
in November 2020, Jupyter (aka Solarmarker) is likely Russian in
origin and primarily targets Chromium, Firefox, and Chrome browser
data, with additional capabilities that allow for full backdoor
functionality, including features to siphon information and upload
the details to a remote server and download and execute further
payloads. Forensic evidence gathered by Morphisec shows that
multiple versions of Jupyter began emerging starting May 2020.

In August 2021, Cisco Talos attributed^[3]
the intrusions to a “fairly sophisticated actor largely focused on
credential and residual information theft.” Cybersecurity firm
CrowdStrike, earlier this February, described^[4]
the malware as packing a multi-stage, heavily obfuscated PowerShell
loader, which leads to the execution of a .NET compiled
backdoor.

While previous attacks incorporated legitimate binaries of
well-known software such as Docx2Rtf and Expert PDF, the latest
delivery chain puts to use another PDF application called Nitro
Pro. The attacks start with a deployment of an MSI installer
payload that’s over 100MB in size, allowing them to bypass
anti-malware engines, and obfuscated using a third-party
application packaging wizard called Advanced Installer.

Running the MSI payload leads to the execution of a PowerShell
loader embedded within a legitimate binary of Nitro Pro 13, two
variants of which have been observed signed with a valid
certificate belonging to an actual business in Poland, suggesting a
possible certificate impersonation or theft. The loader, in the
final-stage, decodes and runs the in-memory Jupyter .NET
module.

“The evolution of the Jupyter infostealer/backdoor from when we
first identified it in 2020 proves the truth of the statement that
threat actors are always innovating,” Morphisec researcher Nadav
Lorber said. “That this attack continues to have low or no
detections on VirusTotal further indicates the facility with which
threat actors evade detection-based solutions.”