Overview

overview

10

Static

static

61f70c121d...95.exe

windows7-x64

10

61f70c121d...95.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95

  • Size

    2.4MB

  • Sample

    220919-esp6nsbfdr

  • MD5

    7c456017d18bcd67d119b1852e10ea9c

  • SHA1

    96fbe0db6d5730d5fda4cc3ee41c5b682a0ebb17

  • SHA256

    61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95

  • SHA512

    75f6e33dfc3ed694865710cf946789c2f1923bb70b6d8fe72f4ed0e32f315cb126350d7c1bd95d16d3f179b21d5b52583fb18e3ac4618a3a0bc42d32db7b178b

  • SSDEEP

    49152:6000irolqOGH78ChAaqBi2tSiDLz/FX/8zptVu25IkyjGY:f00i8qONCOaqBiqDLz/VUltk25Iky3

Score
10/10
jokeraspackv2evasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95

    • Size

      2.4MB

    • MD5

      7c456017d18bcd67d119b1852e10ea9c

    • SHA1

      96fbe0db6d5730d5fda4cc3ee41c5b682a0ebb17

    • SHA256

      61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95

    • SHA512

      75f6e33dfc3ed694865710cf946789c2f1923bb70b6d8fe72f4ed0e32f315cb126350d7c1bd95d16d3f179b21d5b52583fb18e3ac4618a3a0bc42d32db7b178b

    • SSDEEP

      49152:6000irolqOGH78ChAaqBi2tSiDLz/FX/8zptVu25IkyjGY:f00i8qONCOaqBiqDLz/VUltk25Iky3

    Score
    10/10
    jokeraspackv2evasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks