Extracted

• • Target

    cd51b02027d6e08d86b90eaa03b3ecf6ea777a129b9bca1631fdf4ea278e1269

  • Size

    111.9MB

  • MD5

    2f89be8512ad3718014b6d0968860c7a

  • SHA1

    ba92697c07d56ad62865b39a732282c32da0169a

  • SHA256

    cd51b02027d6e08d86b90eaa03b3ecf6ea777a129b9bca1631fdf4ea278e1269

  • SHA512

    10b215a47d905c33ad3622a863f7b247e1245800beba0ee0cc895f691c9258487bdc30f1825f1da509463c95df6860fed6279f667c68de25063c77e7570cb8a2

  • SSDEEP

    393216:ePzBr1SCF0LIUYuFBmY54NEZPb+ON85c9ld3:ebBrxM5YuF4jNePbHoWld3

  Score

  10^/10

  discoveryjupyterbackdoorexecutionstealertrojan

  • Jupyter Backdoor/Client payload

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2