General

  • Target

    9b153223956a834dd0cd1697d990916f433bbed33e1255ab294e3fa8a30c19d1

  • Size

    1.9MB

  • Sample

    220724-sxh5tahae2

  • MD5

    6a63cfa7a267b0f37c5c917ceb64b681

  • SHA1

    0257171a1e7492a7536c88d778570f21c00a94e4

  • SHA256

    9b153223956a834dd0cd1697d990916f433bbed33e1255ab294e3fa8a30c19d1

  • SHA512

    23c4a7af56f06e179cddac87f0bb60e9fb8a20ab6391b397a8f3a5eed259a5c269d16e7596632cf77f1a4720abe3cca5029070677d247ff17c9c9f102d3ea078

Malware Config

Extracted

Family

joker

C2

http://httpdownload.oss-cn-hangzhou.aliyuncs.com

Targets

    • Target

      9b153223956a834dd0cd1697d990916f433bbed33e1255ab294e3fa8a30c19d1

    • Size

      1.9MB

    • MD5

      6a63cfa7a267b0f37c5c917ceb64b681

    • SHA1

      0257171a1e7492a7536c88d778570f21c00a94e4

    • SHA256

      9b153223956a834dd0cd1697d990916f433bbed33e1255ab294e3fa8a30c19d1

    • SHA512

      23c4a7af56f06e179cddac87f0bb60e9fb8a20ab6391b397a8f3a5eed259a5c269d16e7596632cf77f1a4720abe3cca5029070677d247ff17c9c9f102d3ea078

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks