Behavioral task
behavioral1
Sample
d2b88963328498024d2f0caa03a0b6cf.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d2b88963328498024d2f0caa03a0b6cf.dll
Resource
win10v2004-20240226-en
General
-
Target
d2b88963328498024d2f0caa03a0b6cf
-
Size
48KB
-
MD5
d2b88963328498024d2f0caa03a0b6cf
-
SHA1
b9054dce6ce6830b038adeca1dbfd77d031ef05f
-
SHA256
545c99533f7d30cc450deeccf786084a8e6be3a2a5d150bd285ffccc14fb40b1
-
SHA512
1211fb1d6dc2f19efa60ae9ab03be028b5feca843d98b48bee33a8060ad7cfaae3b7696de1acd8f8aec9d67792c05fff8ea41f13bfb584e9d247fcfaa8a0bb27
-
SSDEEP
768:VFHw5ENyuT4jafYyMyHyo5z8nJzFmWtT3ELQmN5EK4Sn:VFHw5iBT4jaZ8nJz9T3ELQmN5Ean
Malware Config
Extracted
jupyter
IL-4
http://185.244.213.64
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
Processes:
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d2b88963328498024d2f0caa03a0b6cf
Files
-
d2b88963328498024d2f0caa03a0b6cf.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ