Behavioral task
behavioral1
Sample
5e7624ed20a2ca460d8929d308b96a7a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5e7624ed20a2ca460d8929d308b96a7a.dll
Resource
win10v2004-20231222-en
General
-
Target
5e7624ed20a2ca460d8929d308b96a7a
-
Size
51KB
-
MD5
5e7624ed20a2ca460d8929d308b96a7a
-
SHA1
11457d791f1afb8a421cd870a737596a851b9694
-
SHA256
e5a00c47ceca8d7b271c55b54087c693a23e9e10a5ea0fae033ff29fd4531f0e
-
SHA512
4d53e2e49273ecf0fbd0b7724644dcfb7230443131a7f07ca6a602542926b763b35bbbe5d5bf4cca417004634892276e2728c6524cbd7280ad83f660b592012a
-
SSDEEP
768:FY+wQ7iRyMTJuv+FvTLQCZBPRie5TqwDkuXlJGCLW0:FY+wQoTLQCZVTjoUlJK0
Malware Config
Extracted
jupyter
AG-5
http://167.88.15.115
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e7624ed20a2ca460d8929d308b96a7a
Files
-
5e7624ed20a2ca460d8929d308b96a7a.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ