Loading malware…
SolarMarker is a modular .NET malware family first observed in 2020 and widely tracked under the aliases Jupyter, Polazert, and Yellow Cockatoo. It combines backdoor and infostealing functionality and has also been documented with additional modules for keylogging, form grabbing, cryptocurrency wallet theft, VNC-based remote access, and SOCKS proxying. The malware is notable for pairing credential and browser-data theft with hands-on remote abuse of victim systems, including use of victim browser sessions for account access and financial fraud.
SolarMarker has been distributed primarily through SEO poisoning and related lure infrastructure that places malicious document-themed or software-themed pages in search results. Victims are enticed into downloading oversized signed MSI or EXE payloads disguised as PDFs, forms, or installers, often accompanied by a legitimate decoy application to reduce suspicion. Delivery chains have included fake archive-style pages, fake Google Drive or Microsoft-themed landing pages, Google Sites lures, compromised WordPress pages, and other filtering infrastructure that selectively serves payloads.
Execution commonly relies on obfuscated PowerShell and reflective .NET loading. Observed variants decrypt embedded payloads in memory using XOR or AES-based routines and load assemblies through .NET reflection rather than writing the final stage plainly to disk. Persistence has repeatedly been established through Startup shortcut files combined with custom file-extension handlers in the current user registry hive, causing PowerShell to decrypt and launch the malware at logon. Other variants have used scheduled tasks. SolarMarker operators also consistently used valid Authenticode-signed first-stage payloads, with extensive evidence of repeated abuse of fraudulently obtained code-signing certificates.
The family’s modular architecture has included a backdoor component often referred to as Mars or Deimos, an infostealer component referred to as Jupyter, a keylogger module referred to as Uranus or Uran, a VNC module referred to as Saturn, a form-grabber and wallet-stealing module, and a SOCKS proxy module. Backdoor functionality includes host reconnaissance, encrypted command-and-control communications, execution of arbitrary PowerShell, file transfer, and loading of additional payloads. Infostealing functionality includes theft of browser credentials, cookies, autofill data, saved passwords, payment-card data, and cryptocurrency wallet data, with some variants using Windows DPAPI to decrypt protected browser secrets.
SolarMarker activity has been associated with broad, opportunistic victimization rather than tightly focused sector targeting, although victims have included organizations in finance, healthcare, education, municipal government, and other industries. Reporting has also linked overlapping activity to the ERYTHRITE intrusion set. Operational observations indicate that some SolarMarker affiliates used remote access and hidden-VNC-style capabilities to interact directly with victim browsers and accounts, enabling session abuse, theft of financial information, concealment of fraudulent transactions, and other post-compromise actions beyond simple credential collection.
Infrastructure associated with SolarMarker reportedly became defunct in 2024, and it has been assessed as not currently appearing to be an active threat. Its tradecraft remains significant because it exemplifies the convergence of SEO-poisoning delivery, signed malware, in-memory PowerShell execution, modular credential theft, and interactive on-device fraud.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ERYTHRITE has technical overlaps to another group multiple IT security organizations have labeled as Solarmarker.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Certificates are acquired through the following process: An impostor chooses a business to impersonate. They can pass the first stage of certificate validation process if the business is in a government database. They register a related domain which they will use for domain validation.
Once the backdoor is loaded into memory it is capable of executing arbitrary PowerShell or specific modules from the attacker.
In the process tree, the running PowerShell was the persistent backdoor which loads the VNC client into SearchIndexer.exe.
the script uses “CMD /c” to execute a PowerShell command with the Window option of “hidden”.
It creates “HKEY_CURRENT_USER\Software\Classes\”+$extensionClass+”\shell\open\command,” which holds “powershell -command $binaryDecodeAndExecute.”
When a host is infected, the backdoor will launch on startup.
Overview: Mars-Deimos-RS-2 is .NET binary injected into memory... As mentioned above, the binary is injected into memory by the script and is not written to file.
When a host is infected, the backdoor will launch on startup.
The script was named “DZWhBTixXsCjSOuNobQfpImvelygwUznrLHGPtkFAaMKVYcJ.cMd”, the script is all one line, the variable names are complicated... looking at the beginning, we can see that it is using PowerShell (spelled “poWeRsHEll” to avoid detection methods that look for the word “PowerShell”).
there is a trend where many threat actors add 100 – 900 MB (or even up to 3 GB) of junk bytes to their malware to prevent analysis.
it appears that a user downloaded an executable that was disguised as a Word document.
Overview: Mars-Deimos-RS-2 is .NET binary injected into memory... As mentioned above, the binary is injected into memory by the script and is not written to file.
the attacker attempts to cover their tracks by clearing the Chrome History manually by navigating to the Chrome History tab and removing items.
It decodes the file using the key and two For-Loops... we appear to be indexing into and manipulating $fileTwo using “-bxor”... So it appears that the variable... is a key for decoding $fileTwo before loading it in line 7.
Using this Windows API, the malware can make sure the PowerShell or current window stays hidden at execution.
The Executable then dropped two files: one a .bat script and the other an unreadable file without an extension.
this blog-post discloses—for the first time—the financial fraud carried out by the SolarMarker actor group. In this blog-post, we will introduce SolarMarker—highlighting the Virtual Network Computing (VNC) component which allows threat actors to connect to a victim device and load the victim’s browser data as their own.
167 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SEO-poisoning backdoor with infostealer capability; one sample was found carrying a HuggingFace API key.
SolarMarker is discussed as a malware family abusing code-signing certificates to sign malicious files, with operators repeatedly obtaining new certificates after revocation.
Mentioned only as a malware family sharing some strings with YASS.
A .NET malware family typically delivered via PowerShell/MSI installers using SEO poisoning. It establishes persistence through registry changes and a startup .lnk file tied to a custom file handler, then reflectively loads an encrypted DLL payload. Across variants it has supported browser credential/data theft, crypto-wallet theft, VPN/RDP config theft, and backdoor capabilities including downloading and executing EXEs, PowerShell scripts, .NET DLLs, and running PowerShell commands from C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.