Malware
JessieConTea
JessieConTea is a remote access trojan that uses HTTP(S) for communication.
JessieConTea is a Windows malware family operated by Lazarus Group.
Background
JessieConTea is a remote access trojan that communicates over HTTP(S). It implements roughly 30 commands covering victim filesystem operations, rudimentary process management, file exfiltration in both plain and zipped forms, and downloading and running further tools from the operator's toolkit. Its commands are referenced by 32-bit integers beginning at 0x60D49D97.
In the wild, the malware was distributed through trojanized applications such as DeFi Wallet and Citrix Workspace.
The first portion of its name comes from the POST parameter it generates, named jsessid, while the second portion was inspired by the RTTI symbol ".?AVCHttpConn@@" found within it. C&C traffic is encrypted using RC4.
Source: Malpedia (Fraunhofer FKIE).