jester | b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b

Resubmissions

16-01-2022 12:57

220116-p6z8xafdg4 1

16-01-2022 12:54

220116-p48ghafdf7 10

Analysis

max time kernel
4265059s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
16-01-2022 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b.exe
Size

241KB
MD5

7120733f34bb6d7ccf174779d3058d3f
SHA1

f2392bcadf03bc4c253a95199bf4be1947898255
SHA256

b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b
SHA512

c39778c1e678264c15f85db3b1628e3047375f0671bfa2d756efc053e74a7289f9bc5f5807c9e246e625bfe09bc3e9b8590a67fef2a0710032521225a693745e

Score

10^/10

jester fikuscode stealer

Malware Config

Extracted

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

license_key
D1F0DE359CBD562CCF9326AEEEA8E64E

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b.exe
Token: SeShutdownPrivilege	632	MusNotification.exe
Token: SeCreatePagefilePrivilege	632	MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b.exe
"C:\Users\Admin\AppData\Local\Temp\b06cd56bcb2a95ff2861a0257778e3a8911a7a47d81545138f1257a233267f0b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4052-130-0x000002A51C110000-0x000002A51C152000-memory.dmp

Filesize
264KB

Download
memory/4052-131-0x000002A51C110000-0x000002A51C152000-memory.dmp

Filesize
264KB

Download
memory/4052-132-0x000002A5372A0000-0x000002A5372A2000-memory.dmp

Filesize
8KB

Download