Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
29/10/2022, 13:11
General
-
Target
20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe
-
Size
765KB
-
MD5
8de76e6a5598a529a98333a0d75ba88c
-
SHA1
c54d54f6b63c2013de278660bffc892b6d4c34b2
-
SHA256
20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
-
SHA512
1e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
SSDEEP
12288:6kS8kaK+mrZCTbwGDzur7RtTdpuvYcSMSgKnPlBYC/4RYe491ue814MGEReL/9VG:I8A1CrzuHRtTdpuvgwKnPK749rHMGEkO
Malware Config
Extracted
joker
http://guup.oss-cn-qingdao.aliyuncs.com
https://gutou.oss-cn-beijing.aliyuncs.com
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of FindShellTrayWindow 22 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe"C:\Users\Admin\AppData\Local\Temp\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exeC:\Users\Admin\AppData\Local\Temp\data\20b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae.exe Ìæ»»³ÌÐò 17562⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Temp.downC:\Users\Admin\AppData\Local\Temp\data\Temp.down Æô¶¯³ÌÐò 43323⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
765KB
MD58de76e6a5598a529a98333a0d75ba88c
SHA1c54d54f6b63c2013de278660bffc892b6d4c34b2
SHA25620b80e22a25e54adb3dc9257fc3b5d7de95a5134e109b46cdea6418626e0edae
SHA5121e900552d5a859885c19fd3f5282a6e543512cc8ac83931d6bcbb377a5b9f2cc6f5095626c7bfc2a17d78d35e33631868841d8147cb74f4a99916cbdd51ff711
-
Filesize
932KB
MD59d2022e1f315a8ed89829d4d7ad092ac
SHA1824b3e6b798a8720fa3caa213b64412fdad5024d
SHA25673f625d9f9fb4dbeadfc4bdb847f732419f5b91229828b10a8f9e2fc00d9482e
SHA5128e8693231e574b62c2093ec071d048786e65477e80d777fe69faaf9e0babba668dbba28684c341651533657f84b53fb6f1d140a33cecf3995e3283d2d4f1a453
-
Filesize
932KB
MD59d2022e1f315a8ed89829d4d7ad092ac
SHA1824b3e6b798a8720fa3caa213b64412fdad5024d
SHA25673f625d9f9fb4dbeadfc4bdb847f732419f5b91229828b10a8f9e2fc00d9482e
SHA5128e8693231e574b62c2093ec071d048786e65477e80d777fe69faaf9e0babba668dbba28684c341651533657f84b53fb6f1d140a33cecf3995e3283d2d4f1a453
-
Filesize
120B
MD51286d7c1a9dc5d654b2790057534486d
SHA18ecc25c015f325d8f6988e9f3258498eb48182bf
SHA256942e1f2cc243a0bbaab0978896db8db29021ad2bd7e38d24d9a26107c52fa5a8
SHA512bf5568d51c2d163021a2ba74e8fd0b9df234af10701c1cafcdae0426586e171d1d9b56c84dde5a40a5baa43d711122637fd7c7c3f55c0bb5df6b06bba45c6356
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
248KB