Resubmissions

13-06-2022 00:03

220613-acantscfak 10

13-05-2022 11:28

220513-nkzjtahhen 8

General

  • Target

    7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1.7z

  • Size

    1.9MB

  • Sample

    220613-acantscfak

  • MD5

    52d6cf015c5de21b5f5ebf0ee4f3a871

  • SHA1

    92aa796e662269597d148677a3f86d84b279465c

  • SHA256

    22c221710c9492fc848dbc20ee8833a30648c07a9a7d011511820d751a4117db

  • SHA512

    90c0d09569527170307cde1c133c9c98c36c0175873f46c52fcaf0c81854b52bbb3a113407376d6d20add92756fc6edb95191f4f1f1a2ebdddef70d6ad42af65

Malware Config

Extracted

Family

jupyter

C2

http://146.70.81.82

Targets

    • Target

      7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1

    • Size

      274.0MB

    • MD5

      b7a056258d8a9fdf06367d54b45e84b3

    • SHA1

      7c75a2df3b88791e83ec0dfd3a023f6e8ec7361c

    • SHA256

      7c213efd427bc3a594a4d794cbb40b63ce8a3e3dc19312011cb7ddbf60811da1

    • SHA512

      8c5ce936341b98337c3ec8365d2a3f0cf1e3a2c0dd80f1f141828e84debbcc51455042ceb9d77b850abb55debfd0d272e3fae4e9a7c102fecc85a396fd551c57

    • Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Executes dropped EXE

    • Drops startup file

MITRE ATT&CK Enterprise v6

Tasks