Analysis
-
max time kernel
48s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-10-2022 13:11
General
-
Target
20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe
-
Size
765KB
-
MD5
8de76e6a5598a529a98333a0d75ba88c
-
SHA1
c54d54f6b63c2013de278660bffc892b6d4c34b2
-
SHA256
20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
-
SHA512
1e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
SSDEEP
12288:6kS8kaK+mrZCTbwGDzur7RtTdpuvYcSMSgKnPlBYC/4RYe491ue814MGEReL/9VG:I8A1CrzuHRtTdpuvgwKnPK749rHMGEkO
Malware Config
Extracted
joker
http://guup.oss-cn-qingdao.aliyuncs.com
https://gutou.oss-cn-beijing.aliyuncs.com
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 4 IoCs
-
Suspicious use of FindShellTrayWindow 22 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe"C:\Users\Admin\AppData\Local\Temp\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exeC:\Users\Admin\AppData\Local\Temp\data\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe Ìæ»»³ÌÐò 13482⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Temp.downC:\Users\Admin\AppData\Local\Temp\data\Temp.down Æô¶¯³ÌÐò 18563⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
932KB
MD57ec22099981f740c5c241c2aa4f3c201
SHA15100fe29d98dda7cab795f85e837f61c445c89d9
SHA256d013fdf5892c9d9b5722d902a48fd71c8d17f409dd54952200977110045558f8
SHA5128b704b84ce85785998ba181540e7882ea6ad20973257e940fdcccc90f368d80e5148c9b35e1300f5dbf687f8bca2d180f9690a9148fc9ca514d4d99ab0bca67c
-
Filesize
120B
MD51286d7c1a9dc5d654b2790057534486d
SHA18ecc25c015f325d8f6988e9f3258498eb48182bf
SHA256942e1f2cc243a0bbaab0978896db8db29021ad2bd7e38d24d9a26107c52fa5a8
SHA512bf5568d51c2d163021a2ba74e8fd0b9df234af10701c1cafcdae0426586e171d1d9b56c84dde5a40a5baa43d711122637fd7c7c3f55c0bb5df6b06bba45c6356
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
932KB
MD57ec22099981f740c5c241c2aa4f3c201
SHA15100fe29d98dda7cab795f85e837f61c445c89d9
SHA256d013fdf5892c9d9b5722d902a48fd71c8d17f409dd54952200977110045558f8
SHA5128b704b84ce85785998ba181540e7882ea6ad20973257e940fdcccc90f368d80e5148c9b35e1300f5dbf687f8bca2d180f9690a9148fc9ca514d4d99ab0bca67c
-
Filesize
932KB
MD57ec22099981f740c5c241c2aa4f3c201
SHA15100fe29d98dda7cab795f85e837f61c445c89d9
SHA256d013fdf5892c9d9b5722d902a48fd71c8d17f409dd54952200977110045558f8
SHA5128b704b84ce85785998ba181540e7882ea6ad20973257e940fdcccc90f368d80e5148c9b35e1300f5dbf687f8bca2d180f9690a9148fc9ca514d4d99ab0bca67c
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
8KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
248KB