jester | 2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba | Triage

Analysis

max time kernel
105s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09-03-2022 07:47

Sharing

Report Analysis Logs

General

Target

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe
Size

241KB
MD5

a98e6c3c273263f66fffc6da9ddd2687
SHA1

9d5e782552e0e861b487d568bd3feef89d1bcaa2
SHA256

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba
SHA512

82df4ba9de74b4e5762a5636c1cbccc7ca79fa390e36f0ca8c6031c6a3e2dbcf7cb47ff0750ebcce6b454ec3be8c5e75e69d581daf43cefc380359ed617158d6

Score

10^/10

jester fikuscode stealer

Malware Config

Extracted

Family

jester

Botnet

FikusCode

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

license_key
D1F0DE359CBD562CCF9326AEEEA8E64E

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe

description pid process

Token: SeDebugPrivilege 3604 2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe

C:\Users\Admin\AppData\Local\Temp\2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe
"C:\Users\Admin\AppData\Local\Temp\2e8d37a9b1125fa6fa3be4b89bc4c17f51130205237c12e87f16e586a6624fba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-130-0x000001C03BFC0000-0x000001C03C002000-memory.dmp

Filesize
264KB

Download
memory/3604-131-0x00007FFF89F30000-0x00007FFF8A9F1000-memory.dmp

Filesize
10.8MB

Download