JitterDropper: Sleeping Assemblies

This is easily the longest analysis to date. I spent effectively a week on this analysis, spanning basically 3 individual sample, 2 reports, and (from what I remember) around 60+ pages of analysis.

I won't spoil the analysis of this sample since it was a very special and fun one at that. Many people came along to assist both during and after analysis; check the Acknowledgements section of both reports for mentions of these individuals.

The first report to read is JitterDropper: Sleeping Assemblies, which can be found here. The second report, lasojnmr and Jtnvua: Glaze Of The JitterDropper Donut, can be found here.

Across both reports, we will cover:

• Technical analysis of JitterDropper and its 2 .NET payloads (the samples);
• Attribution for the samples;
• Detection rules for the samples.

This whole adventure was started thanks to OALabs Research's own report on JitterDropper. It gave a good summary of the sample and was very detailed in this matter, but I wanted to take it a step further and do a full analysis myself.

That's all I have to share. Feel free to contact me if you have any questions or comments regarding this analysis

---

Go back to homepage?