SYMBOLCOMMON_NAMEaka. SYNONYMS
win.solarmarker (Back to overview)

solarmarker

aka: Jupyter, Polazert, Yellow Cockatoo

Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search engine optimization (SEO) manipulation to convince users to download malicious documents.

Some of SolarMarker’s capabilities include the exfiltration of auto-fill data, saved passwords and saved credit card information from victims’ web browsers. Besides capabilities typical for infostealers, SolarMarker has additional capabilities such as file transfer and execution of commands received from a C2 server.

The malware invests significant effort into defense evasion, which consists of techniques like signed files, huge files, impersonation of legitimate software installations and obfuscated PowerShell scripts.

References
2024-05-30 ⋅ Hunt.io ⋅ Hunt.io
SolarMarker: Hunt Insights and Findings
solarmarker
2024-05-13 ⋅ Recorded Future ⋅ Insikt Group
Exploring the Depths of SolarMarker's Multi-tiered Infrastructure
solarmarker
2023-11-06 ⋅ VMWare Carbon Black ⋅ Abe Schneider, Alan Ngo, Bria Beathley, Swee Lai Lee
Jupyter Rising: An Update on Jupyter Infostealer
solarmarker
2023-06-08 ⋅ Twitter (@embee_research) ⋅ Embee_research
Practical Queries for Identifying Malware Infrastructure: An informal page for storing Censys/Shodan queries
Amadey AsyncRAT Cobalt Strike QakBot Quasar RAT Sliver solarmarker
2023-02-26 ⋅ Proofpoint ⋅ Andrew Northern
TA569: SocGholish and Beyond
FAKEUPDATES RedLine Stealer solarmarker
2022-09-27 ⋅ Squiblydoo ⋅ Squiblydoo
Solarmarker: The Old is New
solarmarker
2022-04-27 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: SolarMarker
solarmarker
2022-04-15 ⋅ Center for Internet Security ⋅ CIS
Top 10 Malware March 2022
Mirai Shlayer Agent Tesla Ghost RAT Nanocore RAT SectopRAT solarmarker Zeus
2022-04-08 ⋅ Palo Alto Networks Unit 42 ⋅ Inbal Shalev, Irena Damsky, Shimi Cohen
New SolarMarker (Jupyter) Campaign Demonstrates the Malware’s Changing Attack Patterns
solarmarker
2022-02-01 ⋅ Sophos ⋅ Gabor Szappanos, Sean Gallagher
SolarMarker campaign used novel registry changes to establish persistence
solarmarker
2022-01-13 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
Threat Thursday: Jupyter Infostealer is a Master of Disguise
solarmarker
2021-10-28 ⋅ PRODAFT Threat Intelligence ⋅ PRODAFT
Solarmarker In-Depth Analysis
solarmarker
2021-09-21 ⋅ Morphisec ⋅ Nadav Lorber
New Jupyter Evasive Delivery through MSI Installer
solarmarker
2021-08-09 ⋅ Minerva Labs ⋅ Minerva Labs
Thwarting Jupyter Stealer
solarmarker
2021-07-29 ⋅ Talos Intelligence ⋅ Andrew Windsor, Chris Neal
Talos Spotlight: Solarmarker
solarmarker
2021-07-16 ⋅ Binary Defense ⋅ Binary Defense
Mars-Deimos: From Jupiter to Mars and Back again (Part Two)
solarmarker
2021-07-06 ⋅ Binary Defense ⋅ Binary Defense
Mars-Deimos: SolarMarker/Jupyter Infostealer (Part 1)
solarmarker
2021-06-20 ⋅ Squiblydoo ⋅ Squiblydoo
Mars-Deimos: From Jupiter to Mars and Back again (Part Two)
solarmarker
2021-06-11 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Security Intelligence
Tweet on solarmarker/Jupyter malware
solarmarker
2021-04-13 ⋅ eSentire ⋅ eSentire
Hackers Flood the Web with 100,000 Malicious Pages, Promising Professionals Free Business Forms, But Delivering Malware, Reports eSentire
solarmarker
2021-02-08 ⋅ CrowdStrike ⋅ Seb Walla, Tom Henry, Tom Simpson
Blocking SolarMarker Backdoor
solarmarker
2020-12-20 ⋅ Security Magic ⋅ Security Magic
Tracking Jupyter Malware
solarmarker
2020-11-12 ⋅ Morphisec ⋅ Arnold Osipov
Threat Profile: JUPYTER INFOSTEALER
solarmarker

There is no Yara-Signature yet.