Rewterz Threat Alert – A New SolarMarker Infostealer – Active IOCs

Severity

Medium

Analysis Summary

SolarMarker, also known as Jupyter or Yellow Cockatoo, is a sophisticated infostealer malware that emerged in early 2021. It spreads through phishing emails containing malicious attachments or links, and once installed on a system, it collects sensitive information and transmits it to attackers. SolarMarker’s primary objective is to steal login credentials, personal data, and financial information from its victims.

The malware employs various techniques to achieve its goals, including keylogging, form grabbing, and screen capturing. By capturing keystrokes and monitoring web browsing activities, SolarMarker gains access to sensitive data entered by users. It also utilizes obfuscation and anti-analysis techniques to evade detection by security tools.

One notable feature of SolarMarker is its ability to propagate within a network, potentially compromising multiple devices and entire infrastructures. This poses a significant threat to businesses and enterprises.

To protect against SolarMarker and similar threats, it is crucial to implement robust cybersecurity measures. These include keeping software and systems up to date, using strong and unique passwords, deploying reliable anti-malware solutions, and providing user education on phishing and online safety practices.

In its recent campaign, SolarMarker comes bundled with legitimate software named Autodesk and uses it as a decoy.

Impact

• Sensitive Information Theft
• Credential Theft

Indicators of Compromise

MD5

• 32b36cfba56eb9c067dbaed236eb2138
• 0bafac2df7e1f6484ef8275139c2db58
• f49d3021970471bed6e87a05476aac2b
• ec1f09c7a9612ee8b736d452d52d07c7

SHA-256

• 2aa7e2f1a0ba5529f106d01fe26b122be5e048019f5fe8a0d5c76298838fac25
• a75819503eadb1816eee8884801d11ea7e8d1257ead704bca2aea42afe5edada
• daa704e01cde1dcce238cf0a995d6bf7057985d17894c28938bd8d09c45a9fbe
• 330f5067c93041821be4e7097cf32fb569e2e1d00e952156c9aafcddb847b873

SHA-1

• 031c64d7837fcadbc043f2d0670c6f1dbbf19988
• 6c8b8ed483cf0cb10235edb5ff466fb879894cb8
• fe469c27c7f8bc94c943ef7ffe9ddb99e0bc7096
• 326b3a7deec9a2a38fc037d4be32483a0bbcd9e1

Remediation

• Block all threat indicators at your respective controls. Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
• Regularly backing up your important data can help ensure that you don’t lose any critical information in the event of a malware infection or other data loss event.
• Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
• Make sure all of your software, including your operating system and applications, are up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by SolarMarker Stealer and other types of malware.