Overview

overview

10

Static

static

5b3fc67b5d...18.exe

windows7-x64

10

5b3fc67b5d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b3fc67b5dfb5dfa30242529aeeebc16b9ebed31dd10ba6428f701712c6ddd18

  • Size

    57KB

  • Sample

    221028-wfm9zshaf8

  • MD5

    0c1ae4c7ff9d0afc89b4e4338994c1fd

  • SHA1

    cbfb3812449d8212a6b91a3656fd83def272b965

  • SHA256

    5b3fc67b5dfb5dfa30242529aeeebc16b9ebed31dd10ba6428f701712c6ddd18

  • SHA512

    00956fe43095a8cb8f1758aa3015497765e46ad2ba45508d06fb90127e69ebc28f57116f8314e7e5e1cd11f20e56fc291efe18624abf7819d80cc370cbc1c4f0

  • SSDEEP

    768:hBRMLJshpXC1tlRiYTqyFN9Mwxgb+qi90sG3gGaru+6o6cAT5LZwmChDkGBh9OHf:hBFwt8Om/sPruWOLZwmChgGzg+fPVG6Y

Score
10/10
jokerevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      5b3fc67b5dfb5dfa30242529aeeebc16b9ebed31dd10ba6428f701712c6ddd18

    • Size

      57KB

    • MD5

      0c1ae4c7ff9d0afc89b4e4338994c1fd

    • SHA1

      cbfb3812449d8212a6b91a3656fd83def272b965

    • SHA256

      5b3fc67b5dfb5dfa30242529aeeebc16b9ebed31dd10ba6428f701712c6ddd18

    • SHA512

      00956fe43095a8cb8f1758aa3015497765e46ad2ba45508d06fb90127e69ebc28f57116f8314e7e5e1cd11f20e56fc291efe18624abf7819d80cc370cbc1c4f0

    • SSDEEP

      768:hBRMLJshpXC1tlRiYTqyFN9Mwxgb+qi90sG3gGaru+6o6cAT5LZwmChDkGBh9OHf:hBFwt8Om/sPruWOLZwmChgGzg+fPVG6Y

    Score
    10/10
    jokerevasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks