joker | 6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7 | Triage

Submit
Reports

Overview

overview

Static

static

6d881dc614...a7.exe

windows7-x64

6d881dc614...a7.exe

windows10-2004-x64

8

Sharing

General

Target

6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7
Size

124KB
Sample

220919-kes83acdfr
MD5

bcf68ec493c6da5c147ac8531caac217
SHA1

e2b7545c9cecb783a41178c8fcc1bcbc688c2a39
SHA256

6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7
SHA512

1f56b8df607697c9247173523fe8e6f24ffcc0b447d7bc88722a49733c25441087339b6795b35604efa1fa52d9909e89ac09afbdfa9be883e405dd9889002d37
SSDEEP

3072:11i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOks5YmMOMYcYY51i/NU83:ni/NjO5YBgegD0PHzSv3Oai/Nv

Score

10^/10

joker infostealer persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7.exe

Resource

win7-20220812-en

joker infostealer persistence trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7
- Size
  
  124KB
- MD5
  
  bcf68ec493c6da5c147ac8531caac217
- SHA1
  
  e2b7545c9cecb783a41178c8fcc1bcbc688c2a39
- SHA256
  
  6d881dc614ea24578f591e889d50fc5b6fbd7e4cddacad31f83d5232aa0ce2a7
- SHA512
  
  1f56b8df607697c9247173523fe8e6f24ffcc0b447d7bc88722a49733c25441087339b6795b35604efa1fa52d9909e89ac09afbdfa9be883e405dd9889002d37
- SSDEEP
  
  3072:11i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOks5YmMOMYcYY51i/NU83:ni/NjO5YBgegD0PHzSv3Oai/Nv
Score

10^/10

joker infostealer persistence trojan
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jokerinfostealerpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy