New SolarMarker Variant with Improved Evasion Tactics

What has happened?

• SolarMarker operators were observed using stealthy Windows Registry tricks to gain long-lasting persistence on the compromised systems.
• Further, they used signed files, obfuscated PowerShell scripts, large files, and impersonation of legitimate software installers to stay undetected.

The infection chain

• The large file size of the .exe allows the initial stage dropper to bypass automated analysis by antivirus engines. It further downloads and installs a legitimate program to avoid any suspicion.
• In parallel to its execution, the malware executes a PowerShell installer to deploy and execute additional components of SolarMarker.
• The campaign had used two specific components of SolarMarker, a backdoor and an infostealer to perform different operations.

The backdoor and infostealer

• The SolarMarker backdoor is equipped with capabilities to carry out internal reconnaissance, collect system metadata, and upload it to the remote server over an encrypted channel.
• In addition to this, the backdoor implant deploys SolarMarker's information-stealing module on the victim machine. The stealer can pilfer autofill data, passwords, cookies, and credit card details from web browsers.

Conclusion