jester | 676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3

Analysis

Target

676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe
Size

241KB
MD5

997f878cb5c91c553ece1fe2609f252d
SHA1

2a7b2ed3bff6f9723a3b04a9cd4d5e2619364a6e
SHA256

676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3
SHA512

76454b780673754bd7c323ff22e8189086a46da2e37d4cfba251ecff161b261b65d8872a5dc22301c2a606e11d3a8c25f858ce774aca5013e2a3021dfb11b8c6

Score

10^/10

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

Jester
Jester is an information stealer malware written in C#.
stealer jester

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe

C:\Users\Admin\AppData\Local\Temp\676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe
"C:\Users\Admin\AppData\Local\Temp\676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

memory/1924-54-0x0000000000970000-0x00000000009B2000-memory.dmp

Filesize
264KB

Download
memory/1924-55-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/1924-56-0x000000001AD10000-0x000000001AD12000-memory.dmp

Filesize
8KB

Download