General

  • Target

    29cf677f3259c567880791f3c08c048f9e97726c59b46b7b9f9361ac13de08a5

  • Size

    918KB

  • Sample

    221021-fr5emsdcb6

  • MD5

    72233abb3b0ab88ffcb01d0c5840d890

  • SHA1

    361c6f8569a5e2d16c1bc9d92fd6702de6af124c

  • SHA256

    29cf677f3259c567880791f3c08c048f9e97726c59b46b7b9f9361ac13de08a5

  • SHA512

    56860c804740567412679ad11abd6714337da710a245873dc753c5db06c68bd7be1e61a08765fb545fe2f6a4f43ecec292d43d66ed2f9ab94e920e470a023882

  • SSDEEP

    24576:VBmTZE9bUix084d2mVWcaW2nrwqbqzcClwcbcI:qkoPwxWvJNwiT

Malware Config

Targets

    • Target

      29cf677f3259c567880791f3c08c048f9e97726c59b46b7b9f9361ac13de08a5

    • Size

      918KB

    • MD5

      72233abb3b0ab88ffcb01d0c5840d890

    • SHA1

      361c6f8569a5e2d16c1bc9d92fd6702de6af124c

    • SHA256

      29cf677f3259c567880791f3c08c048f9e97726c59b46b7b9f9361ac13de08a5

    • SHA512

      56860c804740567412679ad11abd6714337da710a245873dc753c5db06c68bd7be1e61a08765fb545fe2f6a4f43ecec292d43d66ed2f9ab94e920e470a023882

    • SSDEEP

      24576:VBmTZE9bUix084d2mVWcaW2nrwqbqzcClwcbcI:qkoPwxWvJNwiT

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks