The SysJoker malware has been linked to focused assaults by a Hamas-affiliated risk actor in the course of the Israel-Hamas battle.
The unattributed multi-platform backdoor has undergone vital adjustments, with a shift to the Rust programming language, indicating an entire code rewrite whereas sustaining related functionalities.
In accordance with an advisory printed by Test Level Analysis (CPR) final week, one of many key modifications entails the usage of OneDrive as a substitute of Google Drive for storing dynamic command-and-control (C2) server URLs, offering the risk actor with flexibility in altering C2 addresses.
“The sooner variations of the malware have been coded in C++,” reads the advisory. “Since there isn’t any easy methodology to port that code to Rust, it means that the malware underwent an entire rewrite and should doubtlessly function a basis for future adjustments and enhancements.”
Evaluation of recent SysJoker variants additionally revealed connections to Operation Electrical Powder, a sequence of focused assaults in opposition to Israeli organizations between 2016-2017, beforehand linked to the Gaza Cybergang (aka Molerats). Each campaigns share a singular PowerShell command based mostly on the StdRegProv WMI class.
The Rust variant of SysJoker, submitted to VirusTotal as “php-cgi.exe” on October 12 2023, employs random sleep intervals to doubtlessly evade sandbox and evaluation measures. It operates in two modes based mostly on its presence in a particular path. Throughout the first execution, the malware establishes persistence via PowerShell, whereas subsequent executions retrieve C2 server addresses from OneDrive.
The malware collects system info, together with Home windows model, username and MAC handle, and transmits it to the C2 server. The C2 communication entails a registration course of and a major loop for executing instructions obtained from the server.
Read more on SysJoker: New “Undetected” Backdoor Runs Across Three OS Platforms
Along with the Rust variant, two beforehand undisclosed Home windows variants of SysJoker have been recognized: DMADevice and AppMessagingRegistrar. These variants exhibit extra complexity, with multi-stage execution flows, together with downloader, installer and payload elements.
