SolarMarker, also known as Jupyter, Polazert and Yellow Cockatoo, is a .NET backdoor and information stealer. Victims reach it through search results poisoned to lead to booby-trapped documents.
Attack chain
SEO-poisoned search result
-> downloaded zip
-> installer EXE impersonating real software
-> .NET C2 client injected into memory
-> downloads next stage
-> PowerShell commands run the in-memory module
Capabilities include acting as a C2 client, downloading and running further malware, running PowerShell and process hollowing.
Four generations I compared
| Version label | What changed |
|---|---|
| DN-DN 1.2 | Configuration holds C2 address and version. Collects computer name, OS, architecture, permissions and a hardware-derived ID built from user name, machine name and disk serial. The reply payload is decoded with XOR using a decimal key. |
| CS-DN 1.3 | Adds browser theft (autofill, cookies, passwords from Chrome). Copies the stolen data to another folder first, then reads it from there, a small trick to avoid access alerts. |
| DN-DN FB1 | A loader configuration class appears. The identifier is now 32 random bytes saved to disk as a data file. |
| DR 1.0 | A configuration XOR key is added, plus JSON messages. Requests carry an action field such as ping, get_file and change_status. |
The JSON protocol in DR 1.0
The client pings the server. The reply says whether the task is idle, a file or a command, what type it is (script or executable) and a task ID. Commands are executed without being written to disk; files go to the temp folder. After running, the client reports success and waits again.
client -> {"action":"ping", ...}
server -> {"status":"command" | "file" | "idle", "type":"ps1" | "exe", "task_id": N}
client -> {"action":"get_file", "task_id": N, ...}
client -> {"action":"change_status", "is_success": true, ...}
server -> {"status":"idle"}
Indicators from the notes
45.135.232.131 45.146.165.222 45.146.165.219 91.241.19.21
gogohid[.]com spacetruck[.]biz mixblazerteam[.]com