General

  • Target

    20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae

  • Size

    765KB

  • Sample

    221029-qezczahdfr

  • MD5

    8de76e6a5598a529a98333a0d75ba88c

  • SHA1

    c54d54f6b63c2013de278660bffc892b6d4c34b2

  • SHA256

    20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae

  • SHA512

    1e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711

  • SSDEEP

    12288:6kS8kaK+mrZCTbwGDzur7RtTdpuvYcSMSgKnPlBYC/4RYe491ue814MGEReL/9VG:I8A1CrzuHRtTdpuvgwKnPK749rHMGEkO

Malware Config

Extracted

Family

joker

C2

http://guup.oss-cn-qingdao.aliyuncs.com

https://gutou.oss-cn-beijing.aliyuncs.com

Targets

    • Target

      20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae

    • Size

      765KB

    • MD5

      8de76e6a5598a529a98333a0d75ba88c

    • SHA1

      c54d54f6b63c2013de278660bffc892b6d4c34b2

    • SHA256

      20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae

    • SHA512

      1e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711

    • SSDEEP

      12288:6kS8kaK+mrZCTbwGDzur7RtTdpuvYcSMSgKnPlBYC/4RYe491ue814MGEReL/9VG:I8A1CrzuHRtTdpuvgwKnPK749rHMGEkO

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks