jester | 00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148 | Triage

Analysis

max time kernel
130s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09-03-2022 07:47

Sharing

Report Analysis Logs

General

Target

00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148.exe
Size

241KB
MD5

3f3f9b87a9ba368414fe1321289aa740
SHA1

20dce6af21500fab7b077446c9f089c761caefc0
SHA256

00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148
SHA512

51dcc7176eb02825310466ff39ddfa45bc87bed184aeed45a00187957df186824b11ede59bea4b4f0fb1a2405c8386e5632507cb0cbe0793dbd50a19ddfbeab5

Score

10^/10

jester fikuscode stealer

Malware Config

Extracted

Family

jester

Botnet

FikusCode

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

license_key
D1F0DE359CBD562CCF9326AEEEA8E64E

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148.exe

description pid process

Token: SeDebugPrivilege 1212 00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148.exe

C:\Users\Admin\AppData\Local\Temp\00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148.exe
"C:\Users\Admin\AppData\Local\Temp\00dbb2b7615fb55d00c299252e0f2b548b0ab5b3617964d1b1802a61fbb3b148.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-130-0x0000026F67D40000-0x0000026F67D82000-memory.dmp

Filesize
264KB

Download
memory/1212-131-0x00007FFE40BD0000-0x00007FFE41691000-memory.dmp

Filesize
10.8MB

Download
memory/1212-132-0x0000026F6B920000-0x0000026F6B922000-memory.dmp

Filesize
8KB

Download