Overview

overview

10

Static

static

28f54c99f3...2b.exe

windows7-x64

1

28f54c99f3...2b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28f54c99f30d95afb0e39e84f50e95eff2d28f0ef581a0ca85ef85f14426f62b

  • Size

    164KB

  • Sample

    220919-aaqbhafhe4

  • MD5

    e4efd05727da503cd4bd06139f0841f5

  • SHA1

    5a59d48b04018e30c1b152fc0b884eb4a853f4e2

  • SHA256

    28f54c99f30d95afb0e39e84f50e95eff2d28f0ef581a0ca85ef85f14426f62b

  • SHA512

    0a1c24ab8823c31158980b3fc39f3fd9a1727e4f36cb3c16afcaafc7ec00b979f26245fab53d7641640e95d04a97818d52cbc3c46b8a502c55479558f9b31e87

  • SSDEEP

    3072:TL+7Du+WxLPt0fyHJBpn5Fu1k42FEmGf8Y:TL+7i+yVdJBpn5sJ2FQJ

Score
10/10
jokerevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      28f54c99f30d95afb0e39e84f50e95eff2d28f0ef581a0ca85ef85f14426f62b

    • Size

      164KB

    • MD5

      e4efd05727da503cd4bd06139f0841f5

    • SHA1

      5a59d48b04018e30c1b152fc0b884eb4a853f4e2

    • SHA256

      28f54c99f30d95afb0e39e84f50e95eff2d28f0ef581a0ca85ef85f14426f62b

    • SHA512

      0a1c24ab8823c31158980b3fc39f3fd9a1727e4f36cb3c16afcaafc7ec00b979f26245fab53d7641640e95d04a97818d52cbc3c46b8a502c55479558f9b31e87

    • SSDEEP

      3072:TL+7Du+WxLPt0fyHJBpn5Fu1k42FEmGf8Y:TL+7i+yVdJBpn5sJ2FQJ

    Score
    10/10
    jokerevasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks