aecifo

This new malware uses a rare programming language to evade traditional detection methods

Umito November 9, 2024

New custom malware loader written in JPHP wreaks havoc
Custom payload is difficult to detect using cybersecurity tools
Malware loader can deploy custom payloads as needed

Trustwave SpiderLabs claims to have recently discovered a new form of malware known as Pronsis Loader, which is already causing problems due to its unique design and tactics.

Pronsis Loader uses JPHP, a lesser-known programming language rarely used by cybercriminals, and also employs advanced installation techniques, making it more difficult for cybersecurity systems to detect and mitigate.

JPHP, a variant of the popular PHP language, is rarely seen in the world of malware development. Although PHP is commonly used for web applications, its integration into desktop malware development is unusual, giving Pronsis Loader an advantage in avoiding detection.

JPHP – a rare choice when it comes to cybercrime

Pronsis Loader can evade signature-based detection systems, which are typically designed to recognize the most common programming languages in malware. JPHP gives the malware a layer of “stealth” allowing it to go unnoticed by many security tools.

The malware also uses obfuscation and encryption methods to hide its presence during the initial phase of infection. During its execution, it deploys complex methods to avoid triggering the antivirus software and endpoint protection systems. The loader first installs itself silently in the system, masking its activities by imitating legitimate processes or applications, making it difficult to detect by automated security tools and human analysts.

Once installed, Pronsis Loader may download and execute additional malware, including ransomwarespyware or data exfiltration tools. This modular approach makes the malware very flexible, allowing attackers to tailor the final payload depending on the target’s system or environment. Pronsis Loader is part of a growing trend in malware development in which attackers use loaders as the first step in multi-stage attacks. These loaders, designed to introduce other malware into a system, provide flexibility to attackers.

To combat these evolving threats, security teams must adopt more advanced monitoring and analysis methods, such as behavior-based detection, which can identify malware by its actions rather than just its code signatures. . Additionally, ongoing threat intelligence updates can help identify the use of rare languages and methods like those employed by Pronsis Loader.

“Pronsis Loader marks a notable shift in the way cybercriminals deploy malware, using JPHP and silent installations to evade traditional detection methods. Its ability to deliver high-risk payloads like Lumma Stealer and Latrodectus makes it particularly dangerous,” said Shawn Kanady, Global Director. from Trustwave SpiderLabs.

“Our research reveals not only the unique capabilities of the malware, but also the infrastructure that could be leveraged in future campaigns to give security teams a chance to strengthen their defenses,” Kanady added.