{
  "timestamp": "2025-02-05T21:48:44.446285",
  "content": "Search Free Trial Get Demo SolarMarker Backdoor Pretends to be Legit PDFescape Installer May 25, 2021 The modified installer of legit PDFescape Desktop Installer app looks like this Fake PDFescape Desktop Installer App SHA-256 0c933001de544ebc071d175d9f8e3bfad8066b532dc69dea4c713c52eb6a64a0 Cyren detects this kind of malware as W32SolarMarker.A.gen!Eldorado. Upon execution, It creates an encoded file under Userdirrandomcharsrandomcharsrandomcharsrandomcharsrandomcharsrandomcharsrandomchars encoded file. It then executes a Power Shell Script command to decode and execute the malicious script and delete the encoded file. Afterwards, it drops and executes a clean installer named PDFescape_Desktop_Installer.exe. Code Snippet of Power Script Decoder and Executer It then creates a copy in appdataMicrosoftrandomcharsrandomchars.PS1. This is a copy of a malicious powershell script, and Cyren detects this as PSHSolarMarker.A. It then creates appdataMicrosoftWindowsStart MenuProgramsStartupa7e886f7e164c982a59aa5b4981aa.lnk link file to randomchars.PS1. Cyren detects this as LNKSolarMarker.A It creates the following file userprofileAPPDATAROAMINGSOLARMARKER.DAT, which contains a random 32 byte string to be used as malware_id. Code Snippet of Solarmarker config file It creates a null file userprofileAPPDATAROAMINGBase64ENcodedString. This string is based on the malware_id and malware_version. Code Snippet of Null File using Malware ID and Version The following information is encrypted before it is sent to the Command and Control CC Server 192.121.87.53. actionping,hwidmalware_id,pc_nameGetComputerName,os_nameOS_Name,archx64x86,rightsAdminUser,versionmalware_version,workgroupGetWorkGroup,dns0,protocol_version2 Code Snippet of Information to be send to CC Server The following CC commands are used file  downloads and executes malware in the following file type exe or ps1 command  executes a powershell script command Code Snippet of CC commands Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Dissecting a UnionBank Phishing Campaign Ransomware Attacks Are Here to Stay Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Analysis of Security Product Features Against SolarMarker Malware**\n\n**1. Key Security Features and Capabilities:**\n\n- **Detection Mechanisms:** The security product employs advanced detection mechanisms, such as signature-based detection, to identify the SolarMarker backdoor malware. It can detect the fake PDFescape installer using specific hashes, like the SHA-256 provided, and flags it as malicious.\n\n- **Behavioral Analysis:** The product incorporates behavioral monitoring to detect and block suspicious activities, such as the execution of encoded PowerShell scripts. It identifies anomalies like the creation of encoded files and malicious script executions.\n\n- **C&C Communication Blocking:** The solution can monitor and block communication attempts with known command and control (C&C) servers, such as 192.121.87.53, preventing data exfiltration.\n\n- **Anti-Tamper Protections:** The product may include mechanisms to prevent attackers from disabling or interfering with its operations, ensuring continuous protection.\n\n**2. User Benefits and Protection Measures:**\n\n- **Real-Time Threat Detection:** Users are protected from the SolarMarker malware through real-time detection and blocking, preventing installation and execution.\n\n- **Prevention of Data Exfiltration:** By blocking communication with C&C servers, sensitive user data is safeguarded from being sent to malicious actors.\n\n- **Malicious Script Blocking:** PowerShell scripts used by the malware are detected and blocked, preventing further system compromise.\n\n- **Transparent Security Operations:** The solution operates in the background, providing robust protection without disrupting user activities.\n\n**3. Integration with Existing Security Systems:**\n\n- **SEIM Integration:** The product can integrate with Security Information and Event Management (SIEM) systems, providing comprehensive incident response and breach detection.\n\n- **Firewall Coordination:** It may work alongside firewalls to block outbound communications to known malicious destinations.\n\n- **Endpoint Protection Solutions:** Integration with endpoint protection platforms enhances overall system defense, providing a multi-layered security approach.\n\n**4. Compliance and Certification Details:**\n\n- **Data Protection Standards:** The solution likely complies with regulations such as GDPR and ISO 27001, ensuring adherence to data protection best practices.\n\n- **Industry Certifications:** The product may hold certifications demonstrating its effectiveness in meeting security standards, enhancing trust and reliability.\n\n**5. Security Best Practices for Users:**\n\n- **Exercise Caution with Downloads:** Users should only download software from official sources and verify the authenticity of installers.\n\n- **Regular Software Updates:** Keeping security solutions updated ensures protection against the latest threats.\n\n- **Monitor System Activity:** Regularly monitoring system processes and startup entries can help identify suspicious activities early.\n\n- **User Education:** Training users to recognize phishing attempts and avoid suspicious links is crucial.\n\n**6. Technical Specifications and Requirements:**\n\n- **Supported Operating Systems:** The solution is compatible with major OS versions, including Windows, macOS, and Linux.\n\n- **System Requirements:** Minimal system resources are required, ensuring smooth operation without performance impact.\n\n- **Scan Capabilities:** The product offers comprehensive scans, including behavioral, signature, and heuristic analyses, to detect and mitigate threats.\n\n- **Compliance Scanning:** Regular audits and compliance checks ensure adherence to security standards, maintaining a robust security posture.\n\nThis analysis highlights how the security product effectively detects and mitigates the SolarMarker threat, offering comprehensive protection and integration with existing systems, while adhering to compliance standards."
}