Analysis
-
max time kernel
30s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
20-10-2022 13:06
General
-
Target
e5383f0501762ed316def303f94ee710388ca0c489bd206b85773240eff0ffcd.exe
-
Size
5.4MB
-
MD5
7ac620a910f5cecec1f2dbfd4e915d51
-
SHA1
d6965d84aa4b33df6eb853ea0839d8265ba072c6
-
SHA256
e5383f0501762ed316def303f94ee710388ca0c489bd206b85773240eff0ffcd
-
SHA512
ec587ff6e5c69c77599e8e71f2c00a19389ce6cf75ff2f2f5b48ec05ea736adc85be4f1332ba554ef21ad7acefcec8c4f724bf5f6e14f6970cdcf44c9386062f
-
SSDEEP
98304:VKsX3qAcEgDRCMTe7TOnAdEqbC0MByhHiHI5vhVlrcN:XnPcEcJTefdeuhHsMvFO
Malware Config
Extracted
joker
https://daohang1.oss-cn-beijing.aliyuncs.com
http://daohang1.oss-cn-beijing.aliyuncs.com
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5383f0501762ed316def303f94ee710388ca0c489bd206b85773240eff0ffcd.exe"C:\Users\Admin\AppData\Local\Temp\e5383f0501762ed316def303f94ee710388ca0c489bd206b85773240eff0ffcd.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
-
Filesize
8KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
1.5MB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
1.5MB