joker | e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1

General

Target

e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
Size

1.9MB
MD5

05ac88e718d0a8e55d612e6e7619ccec
SHA1

848c308fc11f859fac91476e146c6d9f9ee08846
SHA256

e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1
SHA512

af1a14a5a80d97fd0eb4fb60d1da6ff771e86d45aa32aa75511500da8ebf4108fa8e04f119babbd92d05e2a6950319c447c8c0495c2f28a013f373088ada67b9
SSDEEP

49152:sLHxSkIJ0kTZe90YzCHwWvh+TqJQdViG0CaLUKzW+:YSp0ge0YzCHVhVQdVivdj

Score

10^/10

joker infostealer trojan upx vmprotect

Malware Config

Extracted

Family

joker

C2

http://qqydw.oss-cn-beijing.aliyuncs.com

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-54-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/memory/1976-63-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-64-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-66-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-68-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-70-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-72-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-74-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-76-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-80-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-78-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-82-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-84-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-86-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-88-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-90-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-92-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-94-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-96-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-98-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-102-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-100-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-104-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-105-0x0000000010000000-0x0000000010039000-memory.dmp	upx
behavioral1/memory/1976-106-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/memory/1976-108-0x0000000010000000-0x0000000010039000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1976-56-0x00000000028D0000-0x0000000002A9D000-memory.dmp	vmprotect
behavioral1/memory/1976-58-0x00000000028D0000-0x0000000002A9D000-memory.dmp	vmprotect
behavioral1/memory/1976-59-0x00000000028D0000-0x0000000002A9D000-memory.dmp	vmprotect

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
1976	e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe

C:\Users\Admin\AppData\Local\Temp\e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe
"C:\Users\Admin\AppData\Local\Temp\e8ae93e2bee6d0bb0648ca6517b866401f5e19bf2b66a7041b3cc3d5db6528d1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1976-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x00000000028D0000-0x0000000002A9D000-memory.dmp

Filesize
1.8MB

Download
memory/1976-58-0x00000000028D0000-0x0000000002A9D000-memory.dmp

Filesize
1.8MB

Download
memory/1976-59-0x00000000028D0000-0x0000000002A9D000-memory.dmp

Filesize
1.8MB

Download
memory/1976-63-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-64-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-66-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-68-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-70-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-72-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-74-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-76-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-80-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-78-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-82-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-84-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-86-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-88-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-90-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-92-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-94-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-96-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-98-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-102-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-100-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-104-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-105-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/1976-106-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1976-107-0x00000000028D0000-0x0000000002A9D000-memory.dmp

Filesize
1.8MB

Download
memory/1976-108-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing