Extracted

• • Target

    00b4442af9d1fa3ed6dacb22bd133c65278f3c0aca9c331c16035f6b77c428f9

  • Size

    121.8MB

  • MD5

    f456565c272ac8ad9d0751b76cc026bc

  • SHA1

    d2f80b5f1d5756e890a89cca5532dabe8e466d11

  • SHA256

    00b4442af9d1fa3ed6dacb22bd133c65278f3c0aca9c331c16035f6b77c428f9

  • SHA512

    a890eb73154f7c292f5b608646b5303f098423b1c3476f062b71accce0dbde9f41ab170cadfd26912d747524b5dede68d9b81c4eb5147571748a40a9033dc3bc

  • SSDEEP

    393216:4ezBr1SCF0LIUYuFBmY54NEZPb+ON8BM+:4kBrxM5YuF4jNePbH2M+

  Score

  10^/10

  discoveryjupyterbackdoorexecutionstealertrojan

  • Jupyter Backdoor/Client payload

  • Jupyter family

    jupyter

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2