Malware
solarmarker
aka Jupyter · Polazert · Yellow Cockatoo
Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search engine optimization (SEO) manipu
solarmarker, also known as Jupyter, Polazert, Yellow Cockatoo, is a Windows malware family.
Background
Unit 42 reported discovering an updated build of SolarMarker, a family that combines infostealer and backdoor functionality and is primarily spread by abusing search engine optimization (SEO) to lure victims into downloading malicious documents.
The malware can siphon browser auto-fill entries, stored passwords, and saved credit card details from its victims. On top of these typical stealer functions, it also supports transferring files and running commands issued by a C2 server.
Considerable effort goes into avoiding detection, relying on tactics such as code signing, oversized files, posing as legitimate software installers, and heavily obfuscated PowerShell scripts.
Source: Malpedia (Fraunhofer FKIE).