Contents

• Overview
• About Jester Stealer.
• Technical Analysis.
  • Startup Checks and Anti-Analysis Techniques
    • PerformMutexCheck
    • PerformAntiRepeat
    • PerformAntiVM
    • PerformSelfDestruct
    • Garbage-logic.
  • Features
    • Browser-Credential Stealing.
    • Credit-Card Stealing.
    • Crypto-currency wallet.
    • VPN - Credential Stealing.
    • SystemInfo.
    • File Stealing & Screenshot.
    • Telegram Data Stealing
    • Exfiltration.
• IOCs.
• YARA Rule.
• MITRE ATT&CK.

Overview

This blog covers the analysis of a .NET-based stealer that was active during the years 2022 and 2023. The sample we investigated provided key information about the campaign, including metadata that pointed to the developer's online handle, "L1ghtM4n," and the stealer name, "Jester."The executable was fully written in .NET, with all important functions obfuscated using Base64 encoding to avoid detection and make analysis difficult. By examining the sample, we were able to understand how the stealer operates , from its initial anti-analysis steps , to its methods of stealing and exfiltrating sensitive user data.

About Jester Stealer

Jester Stealer started their operation of selling malicious stealer software in December 2022. According to the channel creation date shown in the image (December 26, 2022) and the timestamps in the text file (December 30, 2022), they began advertising their malware service in late December 2022.

Jester Stealer is marketed as "a new, powerful, multifunctional stealer, unique in its kind." It's designed to steal sensitive information from victims' computers, including: Browser data (passwords, credit cards, cookies, autofill information, tokens) Cryptocurrency wallets and exchange extensions Email client credentials Messenger data (Telegram, Discord, WhatsApp, etc.) Password manager contents VPN credentials Gaming platform information System credentials and information.

The malware is sold with different pricing tiers:

$99/month for the executable file $149/3 months for the executable file $249 for lifetime access to the executable and panel $1500 for lifetime access to the builder (allowing customers to create their own versions)

The operation appears to be Russian-based, with prices listed in both USD and RUB. Communication is conducted through Telegram and TOX messenger. The malware provides features like AES-CBC-256 encryption, TOR network support, anti-VM/sandbox protection, and log delivery through Telegram bots.

Technical Analysis

In this section, we take a closer look at the internal structure and behavior of the Jester stealer.

The entire program is heavily obfuscated, with most of its logic written using Base64-encoded strings. This makes it difficult to directly understand the code without decoding it first.

One of the crucial functions we observed, named DS, takes two Base64-encoded strings as input and generates a readable output string. This decoded string appears to play an important role in the next stages of execution.

After generation, the string is passed through another function, which reverses and modifies it further before it is used in the program’s core operations.

Startup Checks and Anti-Analysis Techniques

PerformMutexCheck

PerformMutexCheck function searches for a specific command-line argument that contains the decoded string --debug. If this token is found in the arguments, the stealer skips mutex creation, to avoid detection during testing or debugging.

However, if the decoded string is not found, the program proceeds with generating a mutex named flfamromsu, allowing it to continue with its malicious activities.

PerformAntiRepeat

  The program defines a list of registry root keys like HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and others. These are stored in an array named s_hkeyNames, and one specific root key HKEY_CURRENT_CONFIG is also assigned using a special integer pointer and the malware uses them to interact with the Windows Registry .

The malware utilizes these registry keys to interact with different sections of the Windows Registry. One notable path it accesses is HKEY_CURRENT_USER\\SOFTWARE\\qsdooqwabk where it reads and writes specific values to maintain its execution state and prevent multiple instances from running simultaneously.

Using an obfuscated registry path, it attempts to create a subkey and then checks for a value indicating previous execution. If the value already exists, the program terminates. Otherwise, it writes the value to mark that execution has occurred. This is a persistence method.

PerformAntiVM

The PerformAntiVM function uses multiple techniques to detect if it’s running in a virtual environment or under analysis. It checks for specific command-line arguments, detects attached or active debuggers using Debugger.IsAttached and IsLogging(), looks for suspicious modules using GetModuleHandle, and queries system hardware info via WMI. If any of these checks indicate a virtual or analysis setup, the program exits immediately to avoid detection.

PerformSelfDestruct

The function PerformSelfDestruct consists of event handlers. These event handlers perform specific actions based on different program shutdown scenarios:

UnhandledException (b__1_0): This event is triggered if the program crashes due to an unhandled error.

ProcessExit (b__1_1): This event occurs when the program closes normally, such as when the user exits the application.

DomainUnload (b__1_2): Triggered when the .NET runtime unloads the app domain.

GarbageLogic

The code also contains a lot of garbage code, such as bunch of if statements, which hinder analysis time, as the garbage logic always scales to false. Rest assured, the clean code, looks something like this.

This code is basically network-communication based code.

Features

Browser-Credential Stealing

This stealer, targets various information related to various browsers. Let us see, how does it do that.

At first, it uses the HandleAccount function, to search for all the account usernames, passwords which are in the browser for stealing. The stealer targets various sites which are as follows:

Social Media & Communication Platforms:

Platform	Domain
Facebook	facebook.com
Discord	discord.com
Twitter	twitter.com
VK (Vkontakte)	vk.com
OK (Odnoklassniki)	ok.ru
Reddit	reddit.com
Telegram	telegram.org
ICQ	icq.com
X (Formerly Twitter)	x.com

Gaming Platforms:

Platform	Domain
Steam	steamcommunity.com
Roblox	roblox.com
Epic Games	epicgames.com

Streaming Platforms:

Platform	Domain
Twitch	twitch.tv
YouTube	youtube.com
Netflix	netflix.com
Deezer (Music Streaming)	deezer.com

E-commerce & Online Shopping:

Platform	Domain
Amazon	amazon.com
eBay	ebay.com
Zalando (Fashion e-commerce)	zalando.com

Email & Cloud Storage Services:

Platform	Domain
Gmail	gmail.com
Outlook	outlook.com
Zoho Mail	zoho.com
ProtonMail	proton.me
iCloud	icloud.com
Yandex Mail	yandex.ru
Mail.ru	mail.ru
MediaFire (File Storage)	mediafire.com
MEGA Storage (NZ)	megas.nz

Financial Services:

Platform	Domain
PayPal	paypal.com

Professional Network:

Platform	Domain
Linkdn	linkedin.com

The stealer script constructs the path to Chrome’s Local State file by combining the LocalApplicationData directory (which resolves to C:\Users\<Username>\AppData\Local) with the filename Local State which contains the AES encryption keys required for unlocking stored credentials and cookies. Additionally, it ensures that it interacts with the correct Chrome user profile (such as "Default"), dynamically switching profiles if needed. Along with Chrome, this stealer also similarly steals data from browsers like Firefox, Edge, Opera, Chromium, Vivaldi and many more.

All Chrome-related paths and features are hidden using encoded strings to make it harder for security tools to detect. Once the malware confirms that Chrome is installed and running, it builds full paths to important Chrome folders like Program Files, Program Files (x86), and Google\Chrome\User Data. These folders store sensitive information such as saved passwords, cookies, and browsing history. By finding and reading these files, the stealer can collect login details and session data from the user’s Chrome browser. This allows the attacker to access the user’s accounts without needing their password again.

After locating or validating the session and paths, the malware script checks whether the session involves any application containing the "cookies" module (which we decrypted earlier). If a session with cookies is found, the script dynamically creates an object based on the prtxvwwoftjbakvepnilpwkbdnsrctv interface, which defines required methods like dataUrl, serviceName, requiredCookieName, requiredDomainName, and others to properly manage data extraction.

Credit-Card Stealing

Next, the malware moves on to stealing credit card information stored within the victim's browser, primarily targeting Chrome's autofill system where users often save their card details for convenience. This process involves accessing Chrome’s local profile storage and pulling sensitive fields such as the card number, cardholder’s name, card brand (e.g., VISA/MasterCard), and the expiration date (month and year). Once the data is harvested, the malware encapsulates this information into a structured format, preparing it for exfiltration. It ensures that the stolen card data is correctly linked to the specific Chrome profile it originated from (e.g., "Default" or "Profile 1"), which allows the attackers to associate the credit card details with the relevant user environment. Before sending the data to the attacker-controlled server (C2), it formats the card information into a readable string like:

App: Chrome | Profile: Default | Card: 1234-5678-9012-3456 | Exp: 12/24 | Holder: John Doe | CardName: VISA

Crypto-currency wallet.

This stealer, also targets multiple crypto-currency based wallets such as Exodus, Atomic and much more.

It steals the sensitive info by first checking, if the path exists, in case it exists it copies the folder and saves it to a ZIP later for exfiltration.

VPN - Credential Stealing.

This stealer targets multiple sensitive information like account names and passwords related to multiple VPN providers like Snowflake, NordVPN, EarthVPN. It does by searching for the file account.txt, and once it finds it copies and saves it for exfiltration.

SystemInfo.

Next, the malware collects basic system information from the victim’s machine, mainly the username and computer name. It uses this info to create an identifier like:

{Username}@{MachineName}

For example:

DESKTOP-USER

This ID is added to the HTTP headers when the malware talks to its server (C2). It helps attackers know which victim machine is sending the data. The string is first decrypted and formatted before being sent out, making sure every infected machine has a unique tag. Also, apart from these it collects some other data which is mentioned in this table.

DateTime.Now.ToString()	Environment.UserName	UILanguage	RAMAmount	Manufacturer
Assembly.GetExecutingAssembly().GetName().Version.ToString()	Environment.MachineName	CPUName	DiskSize	ScreenResolution
Assembly.GetExecutingAssembly().Location	OSName	GPUName	Model	LocalIPAddress
PublicIPAddress	GatewayIPAddress	RouterBssid

File Stealing & Screenshot.

The stealer also performs stealing data from various folders of the victim machine, along with that it does also take screenshot from the victim's machine and send all these data to the command and control of this stealer.

Telegram Data Stealing.

The stealer also targets Telegram based information on the victim machine, it does this by first checking the file names and folders in the victim machine, then it uses Registry to look for the key specific to Telegram, once the folder is found, it uses the Collect function to steal the data and then send it to the command and control of the stealer.

Exfiltration.

This stealer uses some creative ways to exfiltrate the stolen data which we saw above, by using two ways one of them is using TOR network and the other being a file sharing service called as Anonfiles.

The stealer does it by first creating a webclient, which is used to build a small connection to the TOR node, upon decrypting the data, we found the TOR address where the stealer is trying to send the data which is basically this address.

hxxp://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/

Then it uploads the report that is the data stolen.

Then it uses the AnonFiles API to upload the zipped stolen data.

IOCs

SHA256	13aaafa5c88a001f4e8b298d77c4b37ae13
Malicious link	github[.]com/L1ghtM4n
TOR link	hxxp://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/
Malicious IP	46[.]173[.]214[.]33

YARA Rule.

MITRE ATT&CK.

Tactic	Technique (with ID)	Description
Initial Access	Spearphishing Attachment (T1566.001)	Delivered via phishing email containing malicious attachments.
Defense Evasion	Obfuscated Files or Information (T1027)	Uses AES encryption and SSD-based string transformation.
Defense Evasion	Virtualization/Sandbox Evasion (T1497)	Checks command-line arguments to evade sandbox/debug environments.
Credential Access	Credential Dumping: Browser Credentials (T1555.003)	Steals Chrome saved passwords from Login Data.
Credential Access	Steal Application Access Token (T1528)	Steals Telegram tdata session files for account hijacking.
Credential Access	Credentials from Password Stores (T1555)	Targets NordVPN credentials or stored session data.
Discovery	System Network Configuration Discovery (T1016)	Uses GetAllNetworkInterfaces to gather network details.
Collection	Browser Session Hijacking (T1539)	Grabs Chrome session cookies
Collection	Archive Collected Data (T1560)	Packages stolen data into a report for exfiltration.
Command and Control	Application Layer Protocol: Web Protocols (T1071.001)	Uses HTTP for direct C2 communication (46[.]173[.]214[.]33:19797).
Command and Control	TOR (T1090.003)	Exfiltrates data via TOR hidden services (.onion domains).
Exfiltration	Exfiltration Over C2 Channel (T1041)	Sends stolen data through the active C2 channels.