Overview

overview

10

Static

static

1

414511c6a3...fb.exe

windows7-x64

10

414511c6a3...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

  • Size

    258KB

  • Sample

    221002-29gbesgcem

  • MD5

    073a7a4183c3be2f8e17e330f7f14a3e

  • SHA1

    1dccd1ea3b1f8cb85802a959100e28a03c69c88d

  • SHA256

    414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

  • SHA512

    c4dadb6da3825f1bc58f43d0979cb661ad8e276e3f7ee92bc1d75fac7ed58eca3dce5dbf657dc3131d8e80676021c2df9abf19b5caf8c69f70c890b244150de0

  • SSDEEP

    6144:lhRpgKLfAX79/Gh++wSR284Z/azGN44XtjxwXiKEeDzwHk/Z7EUaXMal:D+Ls2n84ZCCNPtjxwXiKEenwHk/Zxaf

Score
10/10
jokerevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

    • Size

      258KB

    • MD5

      073a7a4183c3be2f8e17e330f7f14a3e

    • SHA1

      1dccd1ea3b1f8cb85802a959100e28a03c69c88d

    • SHA256

      414511c6a3497dc4b1c22cf57fa7a62d674f1c13a3f8ad34596b01d3bc7997fb

    • SHA512

      c4dadb6da3825f1bc58f43d0979cb661ad8e276e3f7ee92bc1d75fac7ed58eca3dce5dbf657dc3131d8e80676021c2df9abf19b5caf8c69f70c890b244150de0

    • SSDEEP

      6144:lhRpgKLfAX79/Gh++wSR284Z/azGN44XtjxwXiKEeDzwHk/Z7EUaXMal:D+Ls2n84ZCCNPtjxwXiKEenwHk/Zxaf

    Score
    10/10
    jokerevasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Adds policy Run key to start application

      persistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks