Rewterz Threat Alert – JasperLoader Malware Targeting Italian Financial Sector

Severity

Medium

Analysis Summary

Over the past few months, a new malware loader called JasperLoader has emerged that targets Italy and other European countries with banking trojans such as Gootkit. The Jasperloader malware is under continued development and newer updates show signs of antivirus and sandbox evasion techniques. Initial infection vector sources from phishing emails in Italian. These emails contain .zip files with .vbs (Visual Basic Scripting) files inside them. The .vbs file contains highly obfuscated code that utilizes PowerShell to retrieve and execute additional stages of malware for the campaign. The final stage includes installing persistence mechanisms such as .lnk files in the windows startup folder and scheduling of tasks to reinstall/re-infect the target machine. Additional features of the malware include “Geofencing” to limit the infections to a specific geographical area.

Impact

Loss of sensitive information

Indicators of Compromise

URLs

• breed.wanttobea.com zzi.aircargox.com
• nono[.]littlebodiesbigsouls[.]com
• tribunaledinapoli[.]recsinc[.]com
• tribunaledinapoli[.]prepperpillbox[.]com
• tribunaledinapoli[.]lowellunderwood[.]com
• tribunaledinapoli[.]rntman[.]com

Malware Hash (MD5/SHA1/SH256)

• 54666103a3c8221cf3d7d39035b638f3c3bcc233e1916b015aeee2539f38f719

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent from unknown senders.
• Never click on the link/ attachments sent by unknown senders.