Description of Campaign
The SysJoker backdoor was discovered in 2021 and targets Windows, Linux, and macOS systems. The multi-platform malware is written in C++ and reaches out to a hardcoded Google Drive link for a list of current command and control servers. PowerShell, WMIC, cron jobs, and Launch Agents are used for persistence and to gather and exfiltrate sensitive information.

Our ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Intezer and shared publicly.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.
 
Campaign IOC

Type	Value
SHA256	61DF74731FBE1EAFB2EB987F20E5226962EECEEF010164E41EA6C4494A4010FC
SHA256	1FFD6559D21470C40DCF9236DA51E5823D7AD58C93502279871C3FE7718C901C
SHA256	1A9A5C797777F37463B44DE2B49A7F95ABCA786DB3977DCDAC0F79DA739C08AC
SHA256	D028E64BF4EC97DFD655CCD1157A5B96515D461A710231AC8A529D7BDB936FF3
SHA256	BD0141E88A0D56B508BC52DB4DAB68A49B6027A486E4D9514EC0DB006FE71EED
URL	https://bookitlab.tech
URL	https://winaudio-tools.com
URL	https://graphic-updater.com
URL	https://github.url-mini.com
URL	https://office360-update.com

Minimum Content Versions

Content Type	Version
V2 DAT (VirusScan Enterprise)	10230
V3 DAT (Endpoint Security)	4699

  
Detection Summary                               

IOC	Scanner	Detection
61DF74731FBE1EAFB2EB987F20E5226962EECEEF010164E41EA6C4494A4010FC	AVEngine V2	Agent.nf
	AVEngine V3	Agent.nf
	JTI (ATP Rules)	JTI/Suspect.196612!d71e1a6ee832
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
1FFD6559D21470C40DCF9236DA51E5823D7AD58C93502279871C3FE7718C901C	AVEngine V2	GenericRXRM-PV!D90D0F4D6DAD
	AVEngine V3	GenericRXRM-PV!D90D0F4D6DAD
	JTI (ATP Rules)	JTI/Suspect.196612!d90d0f4d6dad
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
1A9A5C797777F37463B44DE2B49A7F95ABCA786DB3977DCDAC0F79DA739C08AC	AVEngine V2	OSX/Agent.f
	AVEngine V3	OSX/Agent.f
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
D028E64BF4EC97DFD655CCD1157A5B96515D461A710231AC8A529D7BDB936FF3	AVEngine V2	SysJoker.a
	AVEngine V3	SysJoker.a
	JTI (ATP Rules)	JTI/Suspect.196612!d71e1a6ee832
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
BD0141E88A0D56B508BC52DB4DAB68A49B6027A486E4D9514EC0DB006FE71EED	AVEngine V2	SysJoker.a
	AVEngine V3	SysJoker.a
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules:
Host Intrusion Prevention: