SoupDealer Malware Evades Sandboxes, AVs, and EDR/XDR in Real-World Attacks

The SoupDealer malware has successfully bypassed nearly all public sandboxes and antivirus solutions, with the exception of Threat.Zone, while also evading endpoint detection and response (EDR) and extended detection and response (XDR) systems in documented real-world incidents.

This advanced threat has inflicted significant damage across various sectors, including banks, internet service providers (ISPs), and mid-level organizations, underscoring the critical need for on-premises sandboxes in protecting essential infrastructure and the importance of genuine dynamic analysis for security operations center (SOC) teams.

Sophisticated Phishing Campaign

Recent investigations by cybersecurity researchers have uncovered a targeted phishing campaign aimed at Windows systems in Türkiye, specifically those configured with the Turkish language, highlighting the malware’s geo-specific focus and its ability to blend into localized environments.

The campaign distributes SoupDealer via deceptive emails containing a three-stage loader disguised as files like “TEKLIFALINACAKURUNLER.jar” or “FIYATTEKLIFI.JAR”.

Upon execution, the malware employs sophisticated persistence methods, such as downloading the TOR browser for anonymous command-and-control (C2) communications and scheduling tasks for automated runs.

It verifies the target’s location and language settings to ensure it operates only within Türkiye, subsequently exfiltrating device information and granting full remote control based on C2 directives.

This self-spreading botnet leverages infected clients’ email accounts to propagate further under C2 guidance, amplifying its reach within networks.

In-Depth Loader Chain

Advanced analysis reveals SoupDealer’s multi-stage architecture, beginning with a Java-based first stage that acts as a custom class loader, heavily obfuscated to thwart decompilation.

Tools like JADX and JByteMod expose 11 classes and an encrypted second-stage payload, with deobfuscation via java-deobfuscator (configured for Allatori string encryption, peephole optimization, and source file normalization) stripping away junk code to reveal core operations.

The loader decrypts resources using AES-ECB with a SHA-512-derived key from the string “875758066416”, yielding the second stage a single-class file with a “stub” that undergoes RC4 decryption to produce the third stage, the core malware payload.

This third stage, post-deobfuscation, performs environmental checks including RAM availability, CPU cores, Windows Server detection, and geolocation via ip-api.com to confirm a Turkish origin.

It escalates privileges, scans for antivirus presence, and if clear, adds itself to scheduled tasks before downloading TOR from dist.torproject.org, verifying connectivity through check.torproject.org on port 9050.

The malware then initializes an “Adwind” class with hardcoded configurations, such as ports 49152 and 49153, a password hash, and onion-based C2 domains for secure, TOR-routed connections.

A listener processes 11 distinct signals from the C2, enabling actions like displaying messages or images, capturing screenshots, initiating DDoS attacks, managing files, executing commands, or self-uninstalling.

Further commands within dynamic signals include “spread” for network worm propagation by copying itself to shared folders on local IPs, “killdefender” and “killanti” to disable Windows Defender via PowerShell, “killvss” to exclude its JAR path from scans, “cmd” for arbitrary command execution, “kill” or “fuck” for uninstallation with optional shutdown, and variants for downloading additional JAR payloads.

This structure mirrors loaders in previously analyzed malware, differing primarily in its TOR integration for C2 evasion.

The malware’s success against defenses emphasizes the limitations of cloud-based sandboxes and the value of localized, proxy-routed analysis environments like those using Turkish proxies for dirty-line egress.

Indicator of Compromise (IoCs)

IOC Type	Details
SHA256 Hash	d286acf63f5846e775ba23599e2b5be88d0564d24f29e0646f6cff207249c130 (TEKLIFALINACAKURUNLER.jar)
SHA256 Hash	d286acf63f5846e775ba23599e2b5be88d0564d24f29e0646f6cff207249c130 (FIYATTEKLIFI.JAR)
URL	4ufbghkgmeb7nevhki3vf5rfwmmrb4bb52xcw2qwbh3qo4x773ttnhqd[.]onion
URL	42dtw6kxl5zxfpo25yknm2hmqndafoqynk3m6j2luvhi4epeex6arvyd[.]onion

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!