Overview

overview

10

Static

static

2f60704e2d...ea.exe

windows7_x64

10

2f60704e2d...ea.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea
  • Size 1.7MB
  • Sample211216-w6ltvadddq
  • SHA256 2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea
  • MD5 SHA1 SHA512
Score
10/10
jesterads555mancollectionstealer

Malware Config

Extracted

Family

  • jester

Botnet

  • ads555man

C2

  • http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/ads555man

  • https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

  • efbb42d7-d0db-4f16-a194-3d9d9d1fc654

Attributes
  • license_key

    65EEBAF23D4744267D131CD5BA37E706

Targets

    • Target
      2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea
    • Size 1.7MB
    • SHA256 2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea
    • MD5 SHA1 SHA512
    Score
    10/10
    jesterads555mancollectionstealer

    • Jester

      Jester is an information stealer malware written in C#.

      stealerjester

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks