Overview

overview

10

Static

static

2f60704e2d...ea.exe

windows7_x64

10

2f60704e2d...ea.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea

  • Size

    1.7MB

  • Sample

    211216-w6ltvadddq

  • MD5

    bb9e3c71b3ee3279632905f905ac21c4

  • SHA1

    a2b1d81ec6a21b52f555f5ec7e9cf9a73f937971

  • SHA256

    2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea

  • SHA512

    f63faf0d317fa32fa9e091dfb0327752433c94c2d8171ef1d4b988288012de2062c89c37c87513873010e7ea78e71d54981ca17cec333222eb9ad9bbb9600916

Score
10/10
jesterads555mancollectionstealer

Malware Config

Extracted

Family

jester

Botnet

ads555man

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/ads555man

https://api.anonfiles.com/upload?token=d26d620842507144
Mutex

efbb42d7-d0db-4f16-a194-3d9d9d1fc654

Attributes
  • license_key

    65EEBAF23D4744267D131CD5BA37E706

Targets

    • Target

      2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea

    • Size

      1.7MB

    • MD5

      bb9e3c71b3ee3279632905f905ac21c4

    • SHA1

      a2b1d81ec6a21b52f555f5ec7e9cf9a73f937971

    • SHA256

      2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea

    • SHA512

      f63faf0d317fa32fa9e091dfb0327752433c94c2d8171ef1d4b988288012de2062c89c37c87513873010e7ea78e71d54981ca17cec333222eb9ad9bbb9600916

    Score
    10/10
    jesterads555mancollectionstealer

    • Jester

      Jester is an information stealer malware written in C#.

      stealerjester

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks