jester | 8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69

Analysis

max time kernel
102s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09-03-2022 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe
Size

241KB
MD5

bf31b7ccb10573e3a6f84bac0cbeeae1
SHA1

f5d97b3ff5b7fdb9ca25ee046c901617a6be3878
SHA256

8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69
SHA512

c4c342fb8cdf78c1962a25b510e02afde88890486b5879a3891d8262b1b45bd12de810ed5a258943bc556b184097569a81591cca52f7019927cce854f7d3a1bc

Score

10^/10

jester fikuscode stealer

Malware Config

Extracted

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

license_key
D1F0DE359CBD562CCF9326AEEEA8E64E

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe

description pid process

Token: SeDebugPrivilege 768 8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe

description	pid	process
Token: SeDebugPrivilege	768	8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe

C:\Users\Admin\AppData\Local\Temp\8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe
"C:\Users\Admin\AppData\Local\Temp\8946892a1354aebdd14040128348bd3905c35b40c713e0cf9bdc7426ae24fe69.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 0
1⤵
- Checks processor information in registry
PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-130-0x000001FF42420000-0x000001FF42462000-memory.dmp

Filesize
264KB

Download
memory/768-132-0x000001FF5DFF0000-0x000001FF5DFF2000-memory.dmp

Filesize
8KB

Download
memory/768-131-0x00007FFB6DBB0000-0x00007FFB6E671000-memory.dmp

Filesize
10.8MB

Download