Extracted

• • Target

    Metlife-Disability-Waiver-Of-Premium-Benefit-Rider.msi

  • Size

    104.4MB

  • MD5

    3ef1e803695ceed8baa27d270b3dc649

  • SHA1

    a0dff2e81809ab07a296d0114174eebff40cfada

  • SHA256

    bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71

  • SHA512

    4de1b4f6c720b8dd5d0bf4b4a0d4dc6985de45d056c2c1636ecf4757ac18bb76f696fbfd23e2e7d03eb2027fa945de246db3be2a72bcb6ef9a67c9fd19dcc396

  Score

  10^/10

  discoveryjupyterbackdoorstealertrojan

  • Jupyter Backdoor/Client Payload

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2