JasperLoader Trojan

First observed in early 2019, JasperLoader is a modular downloader trojan primarily targeting financial and government organisations throughout Western Europe.

Threat ID:: CC-3073
Category:: Loader
Threat Severity:: Medium
Threat Vector:: Email spam
Published:: 24 May 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in early 2019, JasperLoader is a modular downloader trojan primarily targeting financial and government organisations throughout Western Europe.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Older JasperLoader campaigns used ZIP file attachments containing malicious DOCM or VBS files as a delivery vector. However, newer variants use hyperlinks embedded into EML files distributed in spam campaigns. These links direct to a file server, where a ZIP file similar to earlier campaigns is downloaded and automatically extracted. Extensive geofencing is used to ensure only target country IP addresses reach the file server, displaying a HTTP 302 temporary site relocation message if this is not the case. The extracted DOCM or VBS files are then executed to download and install JasperLoader, whilst displaying a PDF file to the user.

Once installed, JasperLoader will check the system language and uninstall itself if the following languages are detected; Belarusian, Mandarin, Romanian, Russian or Ukrainian. It will also verify it is not running in a virtual environment before connecting to a command and control (C2) server. Persistence is maintained through the use of scheduled tasks and Windows shortcuts (LNK files) within the Startup folder. JasperLoader will then install any secondary payloads, primarily GootKit, sent from the C2 server.

Remediation steps

Type	Step
	To prevent and detect a trojan infection, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

To prevent and detect a trojan infection, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 14 February 2020 2:42 pm