joker | 02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e | Triage

Submit
Reports

Overview

overview

Static

static

02040d5907...9e.exe

windows7-x64

1

02040d5907...9e.exe

windows10-2004-x64

Sharing

General

Target

02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e
Size

54KB
Sample

220919-aa9edabggm
MD5

4fdfc29228338e44a3e943594a9e12de
SHA1

0ca5bcfaceb764fc2d374fafcfa03767e083070d
SHA256

02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e
SHA512

bf6986810c376750092de678e5da4f0ebcaf5ec7cb96f904ccb706d6c0de256ce615390d9a52bf9fdb21b55efa20dd053b5c79174a720ac4054e7fd8656fb82a
SSDEEP

768:t1kXBrEiDu4jxAfSIYTdL3HZlhnfu21/O/0SOEeXCAiWhBz1tmnGfyHarOfObf:EW4WYTdLLA21GDAC1YptmGf+qOfqf

Score

10^/10

joker evasion infostealer persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e.exe

Resource

win7-20220812-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e.exe

Resource

win10v2004-20220812-en

joker evasion infostealer persistence trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e
- Size
  
  54KB
- MD5
  
  4fdfc29228338e44a3e943594a9e12de
- SHA1
  
  0ca5bcfaceb764fc2d374fafcfa03767e083070d
- SHA256
  
  02040d590778e19253de36b5569b4c9e2cc76cba7e266e475d93d49aa0962e9e
- SHA512
  
  bf6986810c376750092de678e5da4f0ebcaf5ec7cb96f904ccb706d6c0de256ce615390d9a52bf9fdb21b55efa20dd053b5c79174a720ac4054e7fd8656fb82a
- SSDEEP
  
  768:t1kXBrEiDu4jxAfSIYTdL3HZlhnfu21/O/0SOEeXCAiWhBz1tmnGfyHarOfObf:EW4WYTdLLA21GDAC1YptmGf+qOfqf
Score

10^/10

joker evasion infostealer persistence trojan
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

jokerevasioninfostealerpersistencetrojan

© 2018-2025

Terms | Privacy