General

  • Target

    73985908413b4cda64f15b6fb02e9f59d5a6fab19d36a155e9e40da99edd35c3

  • Size

    5.3MB

  • Sample

    220803-k78t8aaefm

  • MD5

    0a735d01ea6deb01af0d28ec831460a5

  • SHA1

    9195bf9b019972add40196954ba2f029c75c71f0

  • SHA256

    73985908413b4cda64f15b6fb02e9f59d5a6fab19d36a155e9e40da99edd35c3

  • SHA512

    f95ece9d7b9efef4c31058c09b491959961a07995e4a11530fcce7c9de41158a8e9f775b8ddf1b6db4bcf939926f40f7ba6f0c341d37a0c4b120cba474c78000

Malware Config

Extracted

Family

joker

C2

https://googleupdate.oss-cn-hangzhou.aliyuncs.com

Targets

    • Target

      73985908413b4cda64f15b6fb02e9f59d5a6fab19d36a155e9e40da99edd35c3

    • Size

      5.3MB

    • MD5

      0a735d01ea6deb01af0d28ec831460a5

    • SHA1

      9195bf9b019972add40196954ba2f029c75c71f0

    • SHA256

      73985908413b4cda64f15b6fb02e9f59d5a6fab19d36a155e9e40da99edd35c3

    • SHA512

      f95ece9d7b9efef4c31058c09b491959961a07995e4a11530fcce7c9de41158a8e9f775b8ddf1b6db4bcf939926f40f7ba6f0c341d37a0c4b120cba474c78000

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks