General

  • Target

    58ba983b7c6ec9c85969ded4f23041f5a33a809f89d0866350e4575a14ee79c7

  • Size

    26KB

  • Sample

    221011-tpqeladdem

  • MD5

    06666bc830652befea0a673bc9cd2f90

  • SHA1

    de5d967737d27c35e889bf65e761ee367b2117bc

  • SHA256

    58ba983b7c6ec9c85969ded4f23041f5a33a809f89d0866350e4575a14ee79c7

  • SHA512

    db8de8d00907614b1867283307460933ee8a97e5ba06260871d113047a4fbd1af4fcb69c80890052b35e49fef032f1c81ecca05e155c0b85d4152e640022949e

  • SSDEEP

    384:roNhPbj62Tj9xec1JmLfBY5vX0kdaXj0eohDTkVOhvF27z/FUxiWtBlwmRz:rEm2Tbar+f0UaXC9yoYf

Malware Config

Extracted

Family

joker

C2

http://mmtie.oss-cn-hangzhou.aliyuncs.com

Targets

    • Target

      58ba983b7c6ec9c85969ded4f23041f5a33a809f89d0866350e4575a14ee79c7

    • Size

      26KB

    • MD5

      06666bc830652befea0a673bc9cd2f90

    • SHA1

      de5d967737d27c35e889bf65e761ee367b2117bc

    • SHA256

      58ba983b7c6ec9c85969ded4f23041f5a33a809f89d0866350e4575a14ee79c7

    • SHA512

      db8de8d00907614b1867283307460933ee8a97e5ba06260871d113047a4fbd1af4fcb69c80890052b35e49fef032f1c81ecca05e155c0b85d4152e640022949e

    • SSDEEP

      384:roNhPbj62Tj9xec1JmLfBY5vX0kdaXj0eohDTkVOhvF27z/FUxiWtBlwmRz:rEm2Tbar+f0UaXC9yoYf

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks