General

  • Target

    4c69704b2429ccebe3755aff969d91af

  • Size

    1.2MB

  • Sample

    240108-zhemeaafdp

  • MD5

    4c69704b2429ccebe3755aff969d91af

  • SHA1

    3c3302ac6dcb2879645f7febb8c90abece2248a0

  • SHA256

    8fd9d58696d032a64bb3b3166f6a1461f6143272803b3e5a091cd66177f3bcae

  • SHA512

    7e85eb8857735cf6911b3c29cba879e8fa0e1b3bd66d6a1ba7f909bc9f2ba76f6fb3dcb515d367735fe9d8f75330bbe6a0d9ff40e452d766a1bc784a6d6b58c4

  • SSDEEP

    24576:Vs+l1U0tCpJ4tWjmged7UBUMR+opMBKwIcZpLKwH9/ui:Vs+3UfpWtWKz4BzRrePpZJtv

Malware Config

Extracted

Family

jupyter

Version

AG-5

C2

http://167.88.15.115

Targets

    • Target

      770658cdc73ef874c0f4daedb014daea71b5c179c1474ecd6d373d89ac45b48c

    • Size

      101.7MB

    • MD5

      e7855be0d144af10db1f2b6179faea44

    • SHA1

      839def9794201600bf87dd11ed0bc8c384209430

    • SHA256

      770658cdc73ef874c0f4daedb014daea71b5c179c1474ecd6d373d89ac45b48c

    • SHA512

      204d5dde86971e6ab62893e4b92fb7e48a77a6f8495a2d7745cf2a549c3fee9739567c7e1b3bb4d3e39729fcf9be9abc5a23e2098a810d4b0c40ae045d5c28c4

    • SSDEEP

      49152:yqe3f6o22222222222222222222222222222222222222222222222222222222w:LSiXaZTujUd3JDSqO

    • Jupyter Backdoor/Client payload

    • Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks