Resubmissions

19-03-2024 22:30

240319-2e8geshe24 10

24-01-2024 00:36

240124-ax8flaeaa5 10

General

  • Target

    Summary-of-Plan-Fee-Changes-and-Investment-Options.exe

  • Size

    300.2MB

  • Sample

    240319-2e8geshe24

  • MD5

    d7bf2353ea8cfa75775f30550b56d582

  • SHA1

    08aa0f6394b4197774ad48e1d8e429c1d1226a37

  • SHA256

    837e7a67db612b25bfd0f94d37cdbe8b2dc1a298fe5641f27a233ea6daa73bf0

  • SHA512

    9c80b91f9f49d862448ad3e4fec1f2e2b473055a4a51ad51672d6227510f0fcecfdfecf3a9985166e3797f9240f29a2ec9896348990755d9bedf07a11050ba10

  • SSDEEP

    49152:gSqNDb4vTNRoETyDeg444444444444444444444444444444444444444444444v:ge

Malware Config

Extracted

Family

jupyter

C2

http://37.120.198.226

Targets

    • Target

      Summary-of-Plan-Fee-Changes-and-Investment-Options.exe

    • Size

      300.2MB

    • MD5

      d7bf2353ea8cfa75775f30550b56d582

    • SHA1

      08aa0f6394b4197774ad48e1d8e429c1d1226a37

    • SHA256

      837e7a67db612b25bfd0f94d37cdbe8b2dc1a298fe5641f27a233ea6daa73bf0

    • SHA512

      9c80b91f9f49d862448ad3e4fec1f2e2b473055a4a51ad51672d6227510f0fcecfdfecf3a9985166e3797f9240f29a2ec9896348990755d9bedf07a11050ba10

    • SSDEEP

      49152:gSqNDb4vTNRoETyDeg444444444444444444444444444444444444444444444v:ge

    • Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks