General

  • Target

    5a53ca7881f64f1d174f2fe9c152397d86ed5a508feb42d20ecf8b2623db7d61

  • Size

    10.4MB

  • Sample

    220802-eh9sbsbbep

  • MD5

    cd16ea3f3cd567c5a527a9adb968871b

  • SHA1

    6d0ae7ccfbce12d2475c0ee771ce36040c64a4d8

  • SHA256

    5a53ca7881f64f1d174f2fe9c152397d86ed5a508feb42d20ecf8b2623db7d61

  • SHA512

    09e66c595eddfb497b1cab86397ffe7fed1ccf91919a6c3f1b860b32d4b729b2f332600b813f7fb39d32e2bd3eeeea65d899fd6051bdad811c60585e3362238d

Malware Config

Extracted

Family

joker

C2

http://laoliehuo.oss-cn-hangzhou.aliyuncs.com

Targets

    • Target

      5a53ca7881f64f1d174f2fe9c152397d86ed5a508feb42d20ecf8b2623db7d61

    • Size

      10.4MB

    • MD5

      cd16ea3f3cd567c5a527a9adb968871b

    • SHA1

      6d0ae7ccfbce12d2475c0ee771ce36040c64a4d8

    • SHA256

      5a53ca7881f64f1d174f2fe9c152397d86ed5a508feb42d20ecf8b2623db7d61

    • SHA512

      09e66c595eddfb497b1cab86397ffe7fed1ccf91919a6c3f1b860b32d4b729b2f332600b813f7fb39d32e2bd3eeeea65d899fd6051bdad811c60585e3362238d

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Stops running service(s)

    • Deletes itself

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks