Analysis
-
max time kernel
151s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 06:22
Behavioral task
behavioral1
Sample
04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe
Resource
win10v2004-20220721-en
General
-
Target
04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe
-
Size
3.1MB
-
MD5
855df0d3ecae8faf5e984b52ea213e13
-
SHA1
95678c3bc95add7b3e80f0f7fd2c4296f6feaaf9
-
SHA256
04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f
-
SHA512
4c8184391668f671916c4046cbd78dde6dc2d8b4708c91e4eae05c9f4fcc81102c72e2f00fce894987a3d7bffb0c341ad130a6b052726021c766f665109a8705
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
resource yara_rule behavioral2/memory/528-130-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-132-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-131-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-138-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-140-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-144-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-142-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-146-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-148-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-150-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-152-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-156-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-158-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-154-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-160-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-164-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-162-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-166-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-168-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-170-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-172-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 528 04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe 528 04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 528 04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe 528 04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe 528 04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5f581898b2ff51c2ccca11993b693c628
SHA1f3477f50a088579c7d132e7846848b4196b4f488
SHA2564f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f
SHA51208bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294
-
Filesize
177KB
MD5f581898b2ff51c2ccca11993b693c628
SHA1f3477f50a088579c7d132e7846848b4196b4f488
SHA2564f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f
SHA51208bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294