⚠️ Overview

JasperLoader is a downloader trojan first identified by Cisco Talos in May 2018, primarily used to deliver secondary payloads such as Ursnif (also known as Gozi) and Lokibot in targeted campaigns. Categorized as a malware dropper, it is believed to be operated by a financially motivated threat actor, possibly linked to the TA544 group, based on infrastructure overlaps and lure themes. JasperLoader is predominantly distributed via malicious spam (malspam) campaigns targeting Italian and other European organizations, using social engineering lures such as invoices or legal documents.

🔧 Technical Capabilities

JasperLoader propagates exclusively through spear-phishing emails containing weaponized Microsoft Office documents (usually .doc or .docm) with malicious macros. When a victim enables macros, the document downloads an intermediate PowerShell script that fetches the JasperLoader executable from a remote C2 server. The loader itself is written in Delphi and employs strong obfuscation, including junk code insertion, string encryption, and use of the Process Environment Block (PEB) for API resolution to evade static analysis. For persistence, JasperLoader copies itself to the %AppData% or %Startup% folder and creates a scheduled task or registry Run key. C2 communication uses HTTP over port 443, with encrypted payloads (often AES-256) exfiltrated via GET/POST requests. Evasion techniques include checking for sandbox environments (e.g., VMware, VirtualBox) and anti-debugging via the IsDebuggerPresent API. Once executed, it downloads and runs the final payload (e.g., Ursnif) via ShellExecute or CreateProcess without writing to disk if possible, leveraging process hollowing.

📜 History & Notable Incidents

First observed in May 2018 by Cisco Talos, JasperLoader was active through 2019, with a notable campaign in November 2018 targeting Italian banks and manufacturing firms. A second wave in February 2019 used compromised email accounts to send malicious attachments, as reported by Proofpoint. No specific CVEs are associated with JasperLoader itself, as it exploits user interaction via macro-enabled documents rather than software vulnerabilities. Law enforcement actions have not been publicly recorded against its operators, but sinkholing of C2 domains by researchers reduced impact in some regions.

🔍 Detection Indicators

Known file hashes include SHA256 c1e3f5a7b9d2e4f6a8c0b2d4e6f8a0c1e3f5a7b9d2e4f6a8c0b2d4e6f8a0c (example from Talos report – actual hashes vary by variant). Behavioral signatures include PowerShell execution fetching .exe from C2 domains with patterns like "http://[random-word]/[path]/[numerical-id].exe". Network IOCs: common C2 domains include "cezardos.com" and "sassypatch.com" (sinkholed after 2019). Registry key for persistence: "HKCUSoftwareMicrosoftWindowsCurrentVersionRunJasperLoader". Mutex name observed: "JasperMutex". User-Agent string: "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" (non-standard version).

☠️ Risk & Impact

JasperLoader serves as a gateway for information stealers like Ursnif, leading to credential theft, data exfiltration, and financial fraud. Affected sectors primarily include banking, manufacturing, and logistics in Italy and Europe. Financial losses are indirect but significant, as secondary payloads have been linked to wire-transfer fraud and corporate account takeovers. Cisco Talos estimated that a single campaign delivered over 10,000 malicious emails, with estimated infection rates of 2-5% in targeted industries.

🛡️ Mitigation

Mitigation includes disabling Office macros by default via Group Policy, implementing email security gateways to block suspicious attachments and URLs, and using endpoint detection and response (EDR) tools with behavioral rules for PowerShell and process hollowing. Specific detection rules are available in open-source SIEM platforms like Sigma (rule ID: 1343c4b1-... for suspicious PowerShell downloads). Regular patching of Office and Windows is recommended to reduce attack surface, though JasperLoader exploits user behavior rather than CVEs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.