Malware

Jupyter Infostealer

Jupyter Infostealer is a Windows malware family first identified in late 2020 and commonly associated with the Yellow Cockatoo, SolarMarker, Polazert, and Deimos activity cluster. It combines browser-focused information theft with a modular .NET implant architecture. Observed variants harvest browser credentials and cookies from Chrome, Microsoft Edge, and Firefox, enabling credential theft and potential session hijacking, and exfiltrate collected information through encrypted command-and-control communications. Related Deimos implant variants emphasize persistent remote access and arbitrary payload execution rather than information theft.

The malware uses heavily obfuscated PowerShell and .NET reflection to decrypt and load payload assemblies in memory. It employs layered evasion including Base64 encoding, XOR decryption, randomized working directories and decoy files, cleanup of intermediate artifacts, obfuscated runtime variables, and code signing on lure executables. Persistence has been established through user-level file-association hijacking paired with Startup-folder shortcuts; other observed variants modified desktop shortcuts. Remote-access components collect host profiling data, establish HTTP-based encrypted command-and-control, and can execute PowerShell, .NET assemblies, and Windows executables. Some Yellow Cockatoo-associated components additionally use process hollowing for payload execution.

Jupyter Infostealer is primarily distributed through SEO poisoning, search-engine redirect abuse, malicious websites and drive-by downloads, and phishing-themed executables masquerading as documents, PDFs, or software installers. Activity has been observed across multiple sectors, with education and healthcare notably affected in some campaigns. Campaigns have appeared broadly opportunistic rather than narrowly targeted.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence2

No-Hoa-Letter-Mortgage.tmp executes powershell.exe which then makes a connection to 185[.]243.112.60... The above PowerShell command was executed to decrypt the .DAT file...

T1059.003Windows Command ShellEvidence1

run specific cmd.exe commands

T1204.002Malicious FileEvidence2

Using LNK files for initial infection and persistence

Persistence

2 techniques

T1112Modify RegistryEvidence1

MITRE ATT&CK TIDs ... T1112 Defense Evasion Modify Registry

T1547.001Registry Run Keys / Startup FolderEvidence2

MITRE ATT&CK TIDs ... T1547.001 Persistence,Privilege Escalation Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Privilege Escalation

2 techniques

T1055Process InjectionEvidence3

“Elastic observed process injection telemetry that shared techniques with the Jupyter Infostealer.”

T1547.001Registry Run Keys / Startup FolderEvidence2

MITRE ATT&CK TIDs ... T1547.001 Persistence,Privilege Escalation Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Stealth

6 techniques

T1027.011Fileless StorageEvidence1

The above PowerShell command was executed to decrypt the .DAT file... with a custom XOR key.

T1036MasqueradingEvidence2

it appears that a user downloaded an executable that was disguised as a Word document.

T1055Process InjectionEvidence3

“Elastic observed process injection telemetry that shared techniques with the Jupyter Infostealer.”

T1070.004File DeletionEvidence1

These same files then get deleted a few minutes after initial infection.

T1564.003Hidden WindowEvidence1

MITRE ATT&CK TIDs ... T1564.003 Defense Evasion Hide Artifacts: Hidden Window

T1620Reflective Code LoadingEvidence2

cmd.exe would be called to run a PowerShell one-liner that reflectively executes the malware.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

MITRE ATT&CK TIDs ... T1112 Defense Evasion Modify Registry

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

The malware has demonstrated credential harvesting... Targeting Chrome, Edge, and Firefox browsers...

T1555Credentials from Password StoresEvidence1

The Jupyter variant shares functionality with Mars Deimos but can also steal cookies from browsers... this malware may steal passwords

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

MITRE ATT&CK TIDs ... T1082 Discovery System Information Discovery

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK TIDs ... T1083 Discovery File and Directory Discovery

Collection

1 technique

T1005Data from Local SystemEvidence1

MITRE ATT&CK TIDs ... T1005 Collection Data from Local System

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Connect to, and communicate with, a command and control (C2) domain ... It connects to the C2 server (address: https://gogohid[.]com/gate?q=ENCODED_HOST_INFO ) sharing a variety of host information and retrieving its first command.

T1071.001Web ProtocolsEvidence1

The malware has demonstrated credential harvesting and encrypted command-and-control (C2) communication capabilities used to exfiltrate sensitive data.

T1105Ingress Tool TransferEvidence2

When clicked, we want our victim machine to reach out to the web server, download the Meterpreter payload into the %TEMP% directory, and execute the malicious payload

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The malware has demonstrated credential harvesting and encrypted command-and-control (C2) communication capabilities used to exfiltrate sensitive data.

INDICATORS OF COMPROMISE

IOCs tracked for this family

72 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

57 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

vmware security blogNews

Nov 6, 2023

Jupyter Rising: An Update on Jupyter Infostealer - VMware Security Blog - VMware

An infostealer malware family that targets Chrome, Edge, and Firefox users via SEO poisoning, search-engine redirects, malicious downloads, and fake installers. It harvests credentials, uses encrypted C2 communications to exfiltrate data, leverages signed binaries and PowerShell-based decryption/loading, and can establish persistence while loading payloads in memory via reflective assembly loading.

elastic security labsNews

Jun 8, 2022

Going Coast to Coast - Climbing the Pyramid with the Deimos Implant - Elastic Security Labs

A malware family previously associated with Deimos; some samples included information-stealing features, but the observed Deimos sample was not leveraged as an information stealer.

elastic security labsNews

Jun 8, 2022

Going Coast to Coast - Climbing the Pyramid with the Deimos Implant

An information-stealing malware previously associated with Deimos activity. The analyzed Deimos sample was not used as an infostealer, although 12.5% of observed Deimos samples retained information-stealing features similar to Jupyter.

squiblydoo blogNews

May 2, 2021

Mars-Deimos: SolarMarker/Jupyter Infostealer (Part 1) - Squiblydoo.blog

A directly related malware variant that shares IOCs and some functionality with Mars Deimos, but is maintained independently by the malware authors and can also steal cookies from browsers.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching72

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Jupyter Infostealer