Overview

overview

10

Static

static

9fd13a68f4...b0.exe

windows7-x64

1

9fd13a68f4...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fd13a68f4b3b20a2f727acbd4e53a7e45fdc85d4bb82fcdb67e1e9a7ff701b0

  • Size

    54KB

  • Sample

    221020-havj8ahfek

  • MD5

    8038a658f9d5c553d4d45f9de14c5907

  • SHA1

    77dc473d3b5e552e94bd45a3d3a9401bd0e030a3

  • SHA256

    9fd13a68f4b3b20a2f727acbd4e53a7e45fdc85d4bb82fcdb67e1e9a7ff701b0

  • SHA512

    a4983db678f8df8bbe9c93f43361783e5975dfc43b9085817518611278285e28f651c51c76c6a089e9c159184a3faabfd8ffb8fa8b0d73cce4f00d9a32b15ee8

  • SSDEEP

    768:gNh5DfiT2+IXeIt1wgOP+kw+tNwsxQkHPrz+N35yKNQbJItygam7RIEMrOQYz0+X:gZWKJJMguNNdxzHni3gkkJIv7R9wg0aT

Score
10/10
jokerevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      9fd13a68f4b3b20a2f727acbd4e53a7e45fdc85d4bb82fcdb67e1e9a7ff701b0

    • Size

      54KB

    • MD5

      8038a658f9d5c553d4d45f9de14c5907

    • SHA1

      77dc473d3b5e552e94bd45a3d3a9401bd0e030a3

    • SHA256

      9fd13a68f4b3b20a2f727acbd4e53a7e45fdc85d4bb82fcdb67e1e9a7ff701b0

    • SHA512

      a4983db678f8df8bbe9c93f43361783e5975dfc43b9085817518611278285e28f651c51c76c6a089e9c159184a3faabfd8ffb8fa8b0d73cce4f00d9a32b15ee8

    • SSDEEP

      768:gNh5DfiT2+IXeIt1wgOP+kw+tNwsxQkHPrz+N35yKNQbJItygam7RIEMrOQYz0+X:gZWKJJMguNNdxzHni3gkkJIv7R9wg0aT

    Score
    10/10
    jokerevasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks