jupyter | 34c8bc7759f366119181b6a06308188ac15aa61e987c1777bb3a1dacbd6e5024 | Triage

Sharing

General

Target

JaffaCakes118_34c8bc7759f366119181b6a06308188ac15aa61e987c1777bb3a1dacbd6e5024
Size

1.9MB
Sample

241224-ax4seawrdl
MD5

35aa5ecfaccd17e7080389d53380cd7d
SHA1

218728981f8c689cdedfca84f665e13af205564c
SHA256

34c8bc7759f366119181b6a06308188ac15aa61e987c1777bb3a1dacbd6e5024
SHA512

9494930561a32079061edafb41a26d47049b89c451206f899be67c49e620372d65c2d589b70b52ee4392afa3b9113ed1b7bb8983b241a31dd7f794fc93a73dd5
SSDEEP

24576:WwnCK/uTz0wSJXrOPQrVCeaQr4cI+vhyda00ips2oZm4yZbc6hrr:sLSJSPGiZxmhbRipcxyZbthX

Score

10^/10

jupyter backdoor discovery execution persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

jupyter

Version

OC-8

C2

http://37.221.114.23

Targets

- Target
  
  Look-Suture-Cross-Reference-Ethicon.msi
- Size
  
  101.7MB
- MD5
  
  d32bff7790a7a7cc09e3fd8a604e4462
- SHA1
  
  8097f23668557b2dcdf6d3aca285c0d499b5c78f
- SHA256
  
  3303926a6468dab25286a65bb9f3e5883a8938e6501031b3b85e21f182d1ed0d
- SHA512
  
  cc5f0ff6e7121970c98efe91dff8846c0216faab8daac0102ece6110cb05d2e4504edd2b191c1f0a571a503c4ea3c51add920b22db9696e70579d5d246a43ac0
- SSDEEP
  
  49152:cwxcLDe+cpl7+GgVVN7HgTrztiIpqtSZFmD:Pa/MpZGgTFZFmD
Score

10^/10

discovery execution persistence privilege_escalation jupyter backdoor stealer trojan
- Jupyter Backdoor/Client payload
- Jupyter family
  jupyter
- Jupyter, SolarMarker
  Jupyter is a backdoor and infostealer first seen in mid 2020.
  backdoor trojan stealer jupyter
- Drops startup file
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Installer Packages

Privilege Escalation

Event Triggered Execution

Installer Packages

Defense Evasion

Modify Registry

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistenceprivilege_escalation

behavioral2

jupyterbackdoordiscoveryexecutionpersistenceprivilege_escalationstealertrojan