Rewterz Threat Alert – Jester Stealer Malware – Active IOCs – Russian-Ukrainian Cyber Warfare

Severity

High

Analysis Summary

The Emergency Response Team of Ukraine has warned about phishing attacks that use the information-stealing malware Jester Stealer on compromised computers. The subject line of the bulk email campaign appears to be a “chemical attack”. These emails contain a link to a macro-laced Microsoft Excel file which leads to computers getting infected with Jester Stealer after opening. In this campaign, the attack operates by downloading and running an .EXE file obtained from compromised web resources, which needs prospective victims to allow macros after viewing the document.

Jester Stealer is an information stealer first analyzed by researchers when it surfaced on hacker forums back in July 2021. This malicious program is designed to steal a wide range of sensitive data from infected machines. Browsing data, account passwords, and financial and banking information theft are all the primary targets of this malware. It also collects information stored in browsers, such as account passwords, email messages, IM app chats, and cryptocurrency wallet information. This stolen information is then transferred to a remote server, where threat actors gather it to use in future attacks or sell it on dark web markets. The info-stealer has anti-analysis capabilities (anti-VM/debug/sandbox), but doesn’t implement any persistence method. Threat actors exfiltrate data through Telegram using statically configured proxy addresses.

Impact

• Data Exfiltration
• Credential Theft
• Information Theft
• Cryptocurrency Wallet Theft

Indicators of Compromise

Domain Name

• igshop[.]net
• dcshost[.]net
• marmaris[.]com[.]ua
• autodoka[.]com[.]ua
• lightnogu5owjjllyo4tj2sfos6fchnmcidlgo6c7e6fz2hgryhfhoyd[.]onion
• wasabiwallet[.]online
• ip-api[.]com

MD5

• d5c9fd40738ac33f59467811c1ceb30b
• d80f1d64e07909d29d7a2a1888931af9
• 4742c9d0a6b5b3b10ae7eb8f6b3e2fe6
• 70ef45cb31af0b6f37be051de4170839

SHA-256

• 5df051b418cd3d51cfcfe17685275e03b0efdf9a80ce237d2deccb3749576092
• f963ed8559ade984e81a95238c4875d4c0a6ff14a7695630429bf98d4235d596
• ef7ddd544267a8781c99f08146d455aa08beab867e0453b07f1131edcbef92b2
• a2234ee40097fa832eb3a533840e86de3933cf216fbf8445d2946cb7b61c887b

SHA-1

• ebe1ca8671686c6867ec7b443b9c5a8a749c45de
• e4559f4fe4db9c01fbc8d4432a3471c1390d1623
• f4708af7d5aaaeb949e22f0e8d5d9dbaaf819cf0
• 1539d0c2657b60a8f75d130faf4ae1468263d103

SHA-256

• https[:]//igshop[.]net/uploads/Map026[.]xlsb
• https[:]//igshop[.]net/uploads/Map023[.]xlsb
• https[:]//igshop[.]net/uploads/Map021[.]xlsb
• https[:]//igshop[.]net/uploads/Updater-Microsoft[.]exe
• https[:]//dcshost[.]net/mail/OfficeUpdaterNew[.]exe
• https[:]//marmaris[.]com[.]ua/misc/Updater-Microsoft[.]exe
• https[:]//autodoka[.]com[.]ua/extra/Updater-Microsoft[.]exe
• http[:]//lightnogu5owjjllyo4tj2sfos6fchnmcidlgo6c7e6fz2hgryhfhoyd[.]onion/stealer/1026977440

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment