Extracted

• • Target

    7ce31f51f539761f9922bec50d38c6b9c0d6cc3a912517d947bc0a49dd507026

  • Size

    118.8MB

  • MD5

    318799e4892e75fc62dc351d311e701d

  • SHA1

    888d333a39a871c3aff5cf1b7c0af2e4eae1e834

  • SHA256

    7ce31f51f539761f9922bec50d38c6b9c0d6cc3a912517d947bc0a49dd507026

  • SHA512

    260e1726edfae089cf972472c233f616cb5c3e9da8b63632a525ea1191cc9231fa1543aace28db470a2e25fd51b88a48dfca6b634b42ecee3feb50fef7f28531

  • SSDEEP

    393216:DpzBr1SCF0LIUYuFBmY54NEZPb+ON8IoJn:DFBrxM5YuF4jNePbHxoJn

  Score

  10^/10

  discoveryjupyterbackdoorexecutionstealertrojan

  • Jupyter Backdoor/Client payload

  • Jupyter family

    jupyter

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2