DeimosMalware
Described by Elastic as being associated with win.jupyter, and being used in the context of initial access, persistence, and C&C capabilities.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information - Indicator Removal from Tools”
- T1027.005Indicator Removal from Tools
“Obfuscated Files or Information - Indicator Removal from Tools”
- T1055Process Injection
“On August 31, 2021, Elastic observed process injection telemetry that shared techniques with the Jupyter Infostealer as reported by Morphisec, Binary Defense, and security researcher Squibydoo [1] [2] [3] [4] [5].”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter - PowerShell”
- T1140Deobfuscate/Decode Files or Information
“Deobfuscate/Decode Files or Information”
- T1547Boot or Logon Autostart Execution
“Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder”
What the reports say
1 report, newest first · the exact sentence from each-
Going Coast to Coast - Climbing the Pyramid with the Deimos Implant“Going Coast to Coast - Climbing the Pyramid with the Deimos Implant”
Indicators in its reports
named in the reports above- www.esentire[.]comin 1 report
- 650326ac2b1100c4508b8a700b658ad7in 1 report
- d2e227be5d58955a8d12db18fca5d787in 1 report
- a5fb52fc397f782c691961d23cf5e785in 1 report
- 4284a9859ab2184b017070368b4a73cdin 1 report
- 89555a8780abdb39d3f1761918c40505in 1 report
- 83e4d9dd7a7735a516696a49efcc2269in 1 report
- d1c086bb3efeb05d8098a20b80fc3c1ain 1 report
- 1e3dadee7a4b45213f674cb23b07d4b0in 1 report
- d6ffa847bb31b563e9b7b08aad22d447in 1 report
- a78b0ce650249ba927e4cf43d02e5[.]savein 1 report
- 216.230.232[.]134in 1 report
- 2c1941847f660a99…1993961d3d3ein 1 report
- hxxps://www.binarydefense[.]com/mars-deimos-solarmarker-jupyter-infostealer-part-1in 1 report
- www.binarydefense[.]comin 1 report
- hxxp://detect-respond.blogspot[.]com/2013/03/the-pyramid-of-pain.htmlin 1 report
- detect-respond.blogspot[.]comin 1 report
- hxxps://blog.morphisec[.]com/jupyter-infostealer-backdoor-introductionin 1 report
- hxxps://blog.morphisec[.]com/new-jupyter-evasive-delivery-through-msi-installerin 1 report
- hxxps://squiblydoo[.]blog/2021/06/20/mars-deimos-from-jupiter-to-mars-and-back-again-part-twoin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.