NCSC (UK)PDF
NCSC-MAR-Jolly-Jellyfish.pdf
Excerpt
Malware Analysis Report
Jolly Jellyfish
15th December 2022
© Crown Copyright 2022
Version 2.0
Jolly Jellyfish
Non-persistent downloader for shellcode embedded in image files
Executive summary
• Jolly Jellyfish downloads and executes shellcode, which is hidden in legitimate bitmap image (BMP) files.
• HTTP is used to download image files.
• Debug information left in the samples suggest the author refers to this malware as fishmaster.
Introduction
Jolly Jellyfish is a Windows executable which downloads and executes shellcode from a hard-coded remote server, using HTTP. Steganography is used to hide the shellcode inside BMP files. Once extracted and, where necessary, decoded, the shellcode is a Cobalt Strike stager. This report covers the an…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by NCSC (UK) on ncsc.gov.uk.
Mentioned in the excerpt
More from NCSC (UK)5
- DAMASCENED PEACOCKNCSC (UK) · Added 26 Nov 2025
- BADBAZAAR and MOONSHINE: Technical analysis and mitigationsNCSC (UK) · Added 10 Apr 2025
- BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actorsNCSC (UK) · Added 10 Apr 2025
- Advisory: Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaignsNCSC (UK) · Added 25 Nov 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
