# Thwarting Jupyter Stealer

**blog.minerva-labs.com/new-iocs-of-jupyter-stealer**

[Tweet](https://twitter.com/share)

Jupyter Stealer is an evolving info stealer that is commonly spread using backdoored
installations. We have recently encountered a new and improved version of this malware,
which allows its operator to upload and execute new payloads to infected devices.


-----

The sample we analyzed came bundled with YTD Video Downloader & Video Converter,
which is a popular software for downloading music and videos from the web. This installation
orchestrates the whole infection process by dropping an encrypted PowerShell script that will
be decrypted and executed by a hidden PowerShell process. Once decrypted, the script is
[responsible for setting up persistence, using the algorithm described here.](https://www.binarydefense.com/mars-deimos-from-jupiter-to-mars-and-back-again-part-two/)

Our variant connects to its C&C server and sends back the computer information (in an
encrypted form). It does not include the credentials stealing functionality hardcoded
anymore, instead, it gets all functional modules from the C&C server. One of the malware's
capabilities, is to upload and execute .exe and .ps1 files to the victim’s machine. This leaves
an attacker with the ability not only to execute different types of attacks, but also to steal any
information from the victim’s computer.

[Minerva Labs prevents Jupyter malware with our Living-off-the-Land Prevention technology,](https://minerva-labs.com/ransomware-protection-2021)
which interferes with attempts to misuse tools built into the system with the intention of
causing damage. This module prevents threats from “trampolining” off such tools to infect the
endpoint or cause damage.

**IOC’s:**

**Hash:**

C5C5B2D3F6E37851DEE79B1B2B19AA7D

**DNS:**

[http://185.244.213[.]64](http://10.10.0.46/about:blank)

[http://37.120.247[.]125](http://10.10.0.46/about:blank)

[« Previous Post](https://blog.minerva-labs.com/supply-chain-attack-we-can-stop-it?hsLang=en-us)
[Next Post »](https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware?hsLang=en-us)


-----

## Interested in Minerva? Request a Demo Below


-----