Extracted

• • Target

    Adobe-Indesign-Business-Plan-Template-Free.msi

  • Size

    108.5MB

  • MD5

    82dbf0d2b49de42dc700df7c96b41eb1

  • SHA1

    509c08fd9805cf2034fec547c0fc962423a96a3b

  • SHA256

    7ada6e666c34aacaf7c93d11ca2e563ec53da37fb23a181631809d0d5ef14387

  • SHA512

    3d256fba291eb2f4a81ef53d8db8a333f3fb26a9a2c90e3c28bb0a944dc8bba2a2c8902232b14e6a9debdf93a2ff100faabb2be2053aac7fc2ccbdbd2f98fc83

  Score

  10^/10

  discoveryjupyterbackdoorstealertrojan

  • Jupyter Backdoor/Client Payload

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2