TF-MAL-js.jadesnow
📛 Threat Title
Malware family: JADESNOW
Description
ThreatFox malware family `js.jadesnow`. Printable name: JADESNOW. Aliases: ChainedDown.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.jadesnow
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jadesnow
IOC database
- Type
- domain
- Value
js.jadesnow- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.jadesnow
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.jadesnow
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:advisory.eventussecurity.com
Once triggered, the loader script downloads encrypted payloads that install multi-stage malware such as JADESNOW INVISIBLEFERRET . The JADESNOW component decodes and executes payloads directly from blockchain data, making detection extremely difficult, while INVISIBLEFERRET establishes remote access for data theft and command execution.
-
web:arstechnica.com
One of the groups Google observed, a North Korean-backed team tracked as UNC5342, uses earlier-stage malware tracked as JadeSnow to retrieve later-stage malware from both the BNB and Ethereum ...
-
web:bladeintel.com
JADESNOW is a JavaScript-based downloader malware family specifically associated with UNC5342 that utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on BNB Smart Chain and Ethereum. UNC5342 EtherHiding on BNB Smart Chain and Ethereum.
-
web:cloud.google.com
JADESNOW JADESNOW is a JavaScript-based downloader malware family associated with the threat cluster UNC5342. JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted.
-
web:cyberpress.org
UNC5342 EtherHiding on BNB Smart Chain and Ethereum Victims are lured with fake job interviews or coding tests that deliver the JADESNOW downloader malware , which then uses EtherHiding to fetch and execute the next‑stage payload INVISIBLEFERRET.
-
web:cybersixt.com
Google exposed UNC5342 (DPRK APT) using EtherHiding—hiding JADESNOW /INVISIBLEFERRET malware in BNB/Ethereum smart contracts—for a resilient, nation-state C2 infrastructure.
-
web:hackmag.com
The researchers report that a smart contract hosts the JADESNOW loader, which interacts with Ethereum to retrieve the third-stage payload (a JavaScript version of the InvisibleFerret malware , which is typically used for long-term espionage).
-
web:malpedia.caad.fkie.fraunhofer.de
JADESNOW is a JavaScript-based downloader malware family associated with the threat cluster UNC5342. JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted.
-
web:mandos.io
Google Threat Intelligence observed UNC5342 using EtherHiding to deliver JADESNOW malware through fake job interviews - marking the first time a nation-state actor has adopted this blockchain -based technique that stores malicious payloads in smart contracts on BNB Smart Chain and Ethereum, making takedowns nearly impossible.
-
web:www.thedefensenews.com
File-based indicators, such as known hashes of JADESNOW samples, can also assist in detection, though the dynamic nature of payload updates limits the effectiveness of signature-based tools. Strategic Context The adoption of blockchain-based malware delivery reflects a broader trend toward resilient, decentralized infrastructure in cyber ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.