New Version of SolarMaker Backdoor Boasts Improved Stealth
Security researchers have spotted an updated version of the SolarMaker malware that boasts improvements related to avoiding detection. SolarMaker is a malware that is primarily known as a backdoor tool.
SolarMaker switches lanes
A researcher team with Palo Alto Networks picked apart the new malware and reported on their findings. According to the researchers, SolarMaker has recently evolved from using Windows portable executable files to now using Windows installer packages in .MSI files. However, for the ongoing campaign using the malware that the researchers are examining, it seems the threat actors are making a shift back to the old .EXE approach, using portable executables.
SolarMaker is known as both a backdoor malware and an infostealer. The malicious software has the ability to scrape information stored in browsers and exfiltrate it to the malware operators, as well as to execute commands received from its C2 server.
A couple of months earlier, in February 2022, SolarMaker resorted to abusing Windows registry values and modifications in order to achieve persistence on the target systems. Now Palo Alto is observing an evolution of this.
Currently, SolarMaker is being distributed as a chunky 260 megabyte installer file, pretending to be the installer for a PDF reader app. The way that the malicious installers are ending up on people's systems instead of the legitimate software is the hackers' ability to manipulate search engines and pack keywords on the malicious pages hosting SolarMaker. This allows for the fake websites hosting the installer with the malware in it to show higher up on search engine result pages.
Dodging security through a fake layer of legitimacy
The large installer files contain legitimate software. However, while the legitimate software is being downloaded and installed, the malicious installer quietly runs PowerShell commands in the background and deploys SolarMaker.
Packing the PowerShell installer method inside a legitimate installation package allows SolarMaker to dodge automated security defenses more effectively and raises its threat level.
The PowerShell script inside the installer is obfuscated and impersonating a legitimate application in a large installer file allows the malware to slip by unnoticed more easily.
