Extracted

• • Target

    3168f18432106cfaf21f48598c1b26b1026de7a0bac69ae548c79dec67be7853.bin

  • Size

    456KB

  • MD5

    b7061d79323a4795c17c4ddda7e46da4

  • SHA1

    c529ceec64e01721078de2d710dc15d694918266

  • SHA256

    3168f18432106cfaf21f48598c1b26b1026de7a0bac69ae548c79dec67be7853

  • SHA512

    8c7e531c46f8a41021e73b2c10b19ab7ef90ea4f4d0ed8b2f65def2945be005aeae96c94fa5fde6225ed768fbc7c5bdb52654a6b5b2adaf88dc3700722675bf8

  Score

  10^/10

  jesterfanyzecollectionspywarestealer

  • Jester

    Jester is an information stealer malware written in C#.

    stealerjester

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2