General

  • Target

    installer-x64.exe.zip

  • Size

    3.6MB

  • Sample

    231229-vtfxdsecgq

  • MD5

    a276bd9771c7e530dcfdeb0be3545bfd

  • SHA1

    64b913ba6e517193d3cab11a22d8bac7837b7834

  • SHA256

    d9ebbb22da7820c2e88a554c75df907a0e3879cda55d8588a3caf0a86956c4d7

  • SHA512

    45e063db27d7aaa411607f9b7f7af5d1ab3d365957445c013913af44936df040c964b1372113f400832b8e2845a6ef68029e5a714a71b266ea796a140ec3cfe3

  • SSDEEP

    49152:9/uONNdMEBHgsE3oon0VKNMkQyCSOpWgiaHeGvn:5uOpMTn0sN5Q/SOppVln

Malware Config

Extracted

Family

jupyter

C2

http://146.70.145.242

Targets

    • Target

      installer-x64.exe

    • Size

      303.1MB

    • MD5

      9b6a7c4cdefa9ac81645edf50878f88e

    • SHA1

      4a0d2e08367a8a1ac43ec9a1e215a6392f81ff12

    • SHA256

      b68a65e9f8cb6aff77c8d1973e60063de53ca052ee6c98919c96decf5ef705a8

    • SHA512

      6712c3d31b3804ad2e381fe14a64421f72a4c2fbe435f57d3651e265f63fe2456bee3104d1fea2f75be2bf04bf60b688a200cbf6aff84f1deba68a8d01c53340

    • SSDEEP

      49152:x+j6K6VcB/CMFLeYrubGGYMwLFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFf:xu

    • Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Blocklisted process makes network request

    • Drops startup file

MITRE ATT&CK Enterprise v15

Tasks