Extracted

• • Target

    Due-Diligence-Checklist-For-Oil-And-Gas-Properties.msi

  • Size

    123.1MB

  • MD5

    c4772d76029004a5512ea6e2ff3be39b

  • SHA1

    6bda1d3e855a87e5295c933994c2bf58399999e9

  • SHA256

    1197067d50dd5dd5af12e715e2cc00c0ba1ff738173928bbcfbbad1ee0a52f21

  • SHA512

    12d2c556e47d6981b17b4db641391288d7a58c6de770500294eca1ae6dbb3a4734443f634c6acf8130400c45b351e7c6c0c6a08f9f98ab3533518735496503fc

  • SSDEEP

    196608:gWbwgv5oCWjcY9NByzo3H3URiwSib+N6eXN:gWUgBoCWAfz+kRkiaNHXN

  Score

  10^/10

  jupyterbackdoorexecutionpersistenceprivilege_escalationstealertrojan

  • Jupyter Backdoor/Client payload

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1