Overview

overview

10

Static

static

bcf2da6011...7a.exe

windows7-x64

10

bcf2da6011...7a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bcf2da6011f0f56191965811d7b0da690fdde6457e5fd7a1042a37cbea70aa7a

  • Size

    18KB

  • Sample

    220919-psbcmachbj

  • MD5

    c5ef1eaebf1e47a694a54fd29712da47

  • SHA1

    76bd4ad239844b6ed757aab254a96c1079fcd1d4

  • SHA256

    bcf2da6011f0f56191965811d7b0da690fdde6457e5fd7a1042a37cbea70aa7a

  • SHA512

    75f10dff7a1fc1ed88d831cebfe97a779cd63944e2a4afe2ea6aec77ed0a0b2dcc26fb2897ec9d4cfff7597aecfdad9677ffa8503b27a08a4329baf3cc462e9a

  • SSDEEP

    384:PWvWCEgpc7GOu6J/3nXyf5bctBRRmJend3gvdTuvFaCh0isN:SEg27dJ35JmJed9EbN

Score
10/10
jokerinfostealerpersistencetrojan

Malware Config

Targets

    • Target

      bcf2da6011f0f56191965811d7b0da690fdde6457e5fd7a1042a37cbea70aa7a

    • Size

      18KB

    • MD5

      c5ef1eaebf1e47a694a54fd29712da47

    • SHA1

      76bd4ad239844b6ed757aab254a96c1079fcd1d4

    • SHA256

      bcf2da6011f0f56191965811d7b0da690fdde6457e5fd7a1042a37cbea70aa7a

    • SHA512

      75f10dff7a1fc1ed88d831cebfe97a779cd63944e2a4afe2ea6aec77ed0a0b2dcc26fb2897ec9d4cfff7597aecfdad9677ffa8503b27a08a4329baf3cc462e9a

    • SSDEEP

      384:PWvWCEgpc7GOu6J/3nXyf5bctBRRmJend3gvdTuvFaCh0isN:SEg27dJ35JmJed9EbN

    Score
    10/10
    jokerinfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks