Overview

overview

10

Static

static

10

2_stealer.exe

windows7-x64

10

2_stealer.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2_stealer
  • Size 226KB
  • Sample231025-dz113seg2t
  • SHA256 45d58041f3aacdf2d3536c39e1db81e23e30c6372ca2bd3be8b2675d472b5d44
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
eternityjestermonika_galagercollectionspywarestealer

Malware Config

Extracted

Family

  • jester

Botnet

  • monika_galager

C2

  • http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/monika_galager

  • https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

  • c6b4a73b-035e-4027-8c9d-f30fcd7f128e

Attributes
  • license_key

    2389157FE6BD3ADCBC3E0EAEF2136325

Targets

    • Target
      2_stealer
    • Size 226KB
    • SHA256 45d58041f3aacdf2d3536c39e1db81e23e30c6372ca2bd3be8b2675d472b5d44
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    eternityjestermonika_galagercollectionspywarestealer

    • Detects Eternity stealer

      stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Jester

      Jester is an information stealer malware written in C#.

      stealerjester

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks