jester | 2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba | Triage

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-en-20211208
submitted
09-03-2022 07:47

Sharing

Report Analysis Logs

General

Target

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe
Size

241KB
MD5

a98e6c3c273263f66fffc6da9ddd2687
SHA1

9d5e782552e0e861b487d568bd3feef89d1bcaa2
SHA256

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba
SHA512

82df4ba9de74b4e5762a5636c1cbccc7ca79fa390e36f0ca8c6031c6a3e2dbcf7cb47ff0750ebcce6b454ec3be8c5e75e69d581daf43cefc380359ed617158d6

Score

10^/10

jester fikuscode stealer

Malware Config

Extracted

Family

jester

Botnet

FikusCode

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

license_key
D1F0DE359CBD562CCF9326AEEEA8E64E

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe

description pid process

Token: SeDebugPrivilege 740 2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe

C:\Users\Admin\AppData\Local\Temp\2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe
"C:\Users\Admin\AppData\Local\Temp\2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-55-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/740-56-0x00000000009F0000-0x0000000000A32000-memory.dmp

Filesize
264KB

Download
memory/740-57-0x000000001AB20000-0x000000001AB22000-memory.dmp

Filesize
8KB

Download