SourTrade Malvertising Uses Browser to Assemble Malware Executable
A malvertising campaign named SourTrade targets retail traders by using browsers and a legitimate Bun runtime to assemble Windows malware executables, evading traditional detection methods.
Why it matters
SourTrade’s use of browsers and legitimate runtime environments to piece together malware complicates detection efforts and challenges traditional signature-based defenses.
SOC impact
Security teams should prioritize detecting anomalous browser activity related to Bun runtime usage and monitor for suspicious assembly of executable components in user environments. Understanding this technique aids in identifying delivery methods that avoid direct malicious file payloads, supporting timely detection and response.
Recommended actions
- Identify assets interacting with TradingView and Solana impersonations
- Monitor browser behavior for Bun runtime activities assembling executables
- Review network traffic for fragmented malware delivery patterns
- Investigate alerts related to unusual executable creation processes
- Correlate user activity with known SourTrade campaign indicators
Executive Summary
The SourTrade malvertising campaign, active since late 2024, specifically targets retail traders by mimicking popular platforms like TradingView and Solana. Instead of delivering a fully formed malicious file, the attack leverages the browser combined with the legitimate Bun runtime to assemble Windows malware executables in fragmented pieces. This approach sidesteps traditional detection systems that rely on identifying complete malware files, presenting a new challenge for defenders.
Operationally, this technique requires security teams to shift focus toward monitoring runtime behaviors and browser processes involved in assembling executables. Recognizing this pattern can enhance threat hunting and incident response activities, especially within environments frequented by retail traders. Analysts should emphasize detection of unusual runtime assembly actions and fragmented delivery tactics to mitigate risks posed by this evolving malvertising approach.
SOC Impact
Security teams should prioritize detecting anomalous browser activity related to Bun runtime usage and monitor for suspicious assembly of executable components in user environments. Understanding this technique aids in identifying delivery methods that avoid direct malicious file payloads, supporting timely detection and response.
Detection and Monitoring of Assembled Executables
- Identify assets interacting with TradingView and Solana impersonations
- Monitor browser behavior for Bun runtime activities assembling executables
- Review network traffic for fragmented malware delivery patterns
- Investigate alerts related to unusual executable creation processes
- Correlate user activity with known SourTrade campaign indicators
Why It Matters
SourTrade’s use of browsers and legitimate runtime environments to piece together malware complicates detection efforts and challenges traditional signature-based defenses.