jester | 676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3

Analysis

Target

676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe
Size

241KB
MD5

997f878cb5c91c553ece1fe2609f252d
SHA1

2a7b2ed3bff6f9723a3b04a9cd4d5e2619364a6e
SHA256

676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3
SHA512

76454b780673754bd7c323ff22e8189086a46da2e37d4cfba251ecff161b261b65d8872a5dc22301c2a606e11d3a8c25f858ce774aca5013e2a3021dfb11b8c6

Score

10^/10

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

Jester
Jester is an information stealer malware written in C#.
stealer jester

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe

C:\Users\Admin\AppData\Local\Temp\676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe
"C:\Users\Admin\AppData\Local\Temp\676853e09ec344b224e66997477ae51ed2580e8c34e318e35275139bec30f1b3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:540

memory/540-130-0x000002B72E0C0000-0x000002B72E102000-memory.dmp

Filesize
264KB

Download
memory/540-131-0x00007FFD3AB90000-0x00007FFD3B651000-memory.dmp

Filesize
10.8MB

Download
memory/540-132-0x000002B749BE0000-0x000002B749BE2000-memory.dmp

Filesize
8KB

Download