joker | 6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091 | Triage

Submit
Reports

Overview

overview

Static

static

6c0d975b4c...91.exe

windows7-x64

6c0d975b4c...91.exe

windows10-2004-x64

Sharing

General

Target

6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091
Size

129KB
Sample

221018-25pr1aeae9
MD5

9ae1ad04a9594aa569f1f98f763afe80
SHA1

e8cb98b4c964903028d246fd39de4d3aee2050e2
SHA256

6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091
SHA512

363b92efb34ebfe85a0d018bf9f8d4d3bc604693d013a9c60f2acdeddab043a9d952477fc721c795df8a79df0799bdafae498bead37a5cdcedfb2c435f3b6308
SSDEEP

3072:k1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1gs5YmMOMYcYY51i/:Ci/NjO5xbg/CSUFLTwMjs6y3Oai/NDt

Score

10^/10

joker infostealer persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091.exe

Resource

win7-20220901-en

joker infostealer persistence trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091.exe

Resource

win10v2004-20220812-en

joker infostealer persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091
- Size
  
  129KB
- MD5
  
  9ae1ad04a9594aa569f1f98f763afe80
- SHA1
  
  e8cb98b4c964903028d246fd39de4d3aee2050e2
- SHA256
  
  6c0d975b4cf537783d5e146d0046be48fc2858c4535645547e7ac7e472e98091
- SHA512
  
  363b92efb34ebfe85a0d018bf9f8d4d3bc604693d013a9c60f2acdeddab043a9d952477fc721c795df8a79df0799bdafae498bead37a5cdcedfb2c435f3b6308
- SSDEEP
  
  3072:k1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1gs5YmMOMYcYY51i/:Ci/NjO5xbg/CSUFLTwMjs6y3Oai/NDt
Score

10^/10

joker infostealer persistence trojan
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jokerinfostealerpersistencetrojan

behavioral2

jokerinfostealerpersistencetrojan

© 2018-2025

Terms | Privacy