joker | 37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec | Triage

Submit
Reports

Overview

overview

Static

static

37903e1d9f...ec.exe

windows7-x64

37903e1d9f...ec.exe

windows10-2004-x64

8

Sharing

General

Target

37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec
Size

740KB
Sample

221003-hjk25sdean
MD5

67ef6a3258121c5c085080180698a2e0
SHA1

9ed5f1c51d5609b1b1402a41f2121676af9e5103
SHA256

37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec
SHA512

b66b367b6c12f195c6b32f665b5bb25d9af9ed96224444236031b5fd9d0306294415dab3f3a489cc63dc0bf5191862485e359f453ff804138b6eb9215e61f803
SSDEEP

12288:+w80KZh/N1tcD1/OVQNvRtYuupRA9gN5UQXGcuWEw/+PxBTApHqxhyjY1NEAIvO+:+w80Kx1SR/Jb8T+QqWGcNXqxdApHYysU

Score

10^/10

joker adware infostealer persistence stealer trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec.exe

Resource

win7-20220812-en

joker adware infostealer persistence stealer trojan upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec
- Size
  
  740KB
- MD5
  
  67ef6a3258121c5c085080180698a2e0
- SHA1
  
  9ed5f1c51d5609b1b1402a41f2121676af9e5103
- SHA256
  
  37903e1d9f8876ee33f42eb2d4d507cc35a37fb4de5408d95be31f3b5a319aec
- SHA512
  
  b66b367b6c12f195c6b32f665b5bb25d9af9ed96224444236031b5fd9d0306294415dab3f3a489cc63dc0bf5191862485e359f453ff804138b6eb9215e61f803
- SSDEEP
  
  12288:+w80KZh/N1tcD1/OVQNvRtYuupRA9gN5UQXGcuWEw/+PxBTApHqxhyjY1NEAIvO+:+w80Kx1SR/Jb8T+QqWGcNXqxdApHYysU
Score

10^/10

joker adware infostealer persistence stealer trojan upx
- Modifies WinLogon for persistence
  persistence
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jokeradwareinfostealerpersistencestealertrojanupx

behavioral2

© 2018-2025

Terms | Privacy