Overview

overview

10

Static

static

1

California...ct.msi

windows7-x64

7

California...ct.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e7b874f8535a012c2f79f7c9540f380ae12680d4e2e1475cc544b581fad244ae

  • Size

    1.9MB

  • Sample

    241226-1t2fzsslep

  • MD5

    43704a290731e189754c209d05fbd783

  • SHA1

    63d82855fa872d9af37eed577d3d245f972d126f

  • SHA256

    e7b874f8535a012c2f79f7c9540f380ae12680d4e2e1475cc544b581fad244ae

  • SHA512

    94823ea6b46e2b2ca1518567c510b4d93b7036c7f89bd2324acc104ced2622f75c56e754750814e38726b358edcbc11d112ddb494bb91e0a888d0c3fecd7b57b

  • SSDEEP

    24576:ZwnCK/uTz0wSJXrOPQrVCeaQr4cI+vhyda00ips2oZm4yZbc6hrx:zLSJSPGiZxmhbRipcxyZbth1

Score
10/10
jupyterbackdoordiscoveryexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

jupyter

Version

OC-8

C2

http://37.221.114.23

Targets

    • Target

      California-Nurses-Association-Kaiser-Contract.msi

    • Size

      101.7MB

    • MD5

      d32bff7790a7a7cc09e3fd8a604e4462

    • SHA1

      8097f23668557b2dcdf6d3aca285c0d499b5c78f

    • SHA256

      3303926a6468dab25286a65bb9f3e5883a8938e6501031b3b85e21f182d1ed0d

    • SHA512

      cc5f0ff6e7121970c98efe91dff8846c0216faab8daac0102ece6110cb05d2e4504edd2b191c1f0a571a503c4ea3c51add920b22db9696e70579d5d246a43ac0

    • SSDEEP

      49152:cwxcLDe+cpl7+GgVVN7HgTrztiIpqtSZFmD:Pa/MpZGgTFZFmD

    Score
    10/10
    discoveryexecutionpersistenceprivilege_escalationjupyterbackdoorstealertrojan

    • Jupyter Backdoor/Client payload

    • Jupyter family

      jupyter

    • Jupyter, SolarMarker

      Jupyter is a backdoor and infostealer first seen in mid 2020.

      backdoortrojanstealerjupyter

    • Drops startup file

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks