jester | 75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f

Analysis

Target

75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f.exe
Size

241KB
MD5

5e88894cf8131309ea5d503025ff2514
SHA1

9309287d451efcd258df72be3bd1d4ddd9090f07
SHA256

75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f
SHA512

3d1d07bc3a281476fe12e9ff25a03ea46a4c5e8804f2095a9bd14e72a40b8fe3da193ac7d12bc975f6088e959d8cf6d5f5005741e570753d20f5df11a753fe5f

Score

10^/10

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

Jester
Jester is an information stealer malware written in C#.
stealer jester

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f.exe

C:\Users\Admin\AppData\Local\Temp\75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f.exe
"C:\Users\Admin\AppData\Local\Temp\75ac96db15096428b6c9d42060f08a6ade84a7c36cf546e726fe09fbe5963f3f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:388

memory/388-130-0x000001B4C0900000-0x000001B4C0942000-memory.dmp

Filesize
264KB

Download
memory/388-131-0x00007FF9BAF70000-0x00007FF9BBA31000-memory.dmp

Filesize
10.8MB

Download
memory/388-132-0x000001B4C0CB0000-0x000001B4C0CB2000-memory.dmp

Filesize
8KB

Download