General

  • Target

    e03dae04b372e4581f8a39bd30c56b4435423c9209ea4d86dbd445faeefafd23

  • Size

    943KB

  • Sample

    221030-ezecrabhd9

  • MD5

    a31c29394aff003f6695119188032150

  • SHA1

    5695a7e86c933e9d20b71aa8e9edb85f3c68d2b0

  • SHA256

    e03dae04b372e4581f8a39bd30c56b4435423c9209ea4d86dbd445faeefafd23

  • SHA512

    ca0e10261d6f2f0cd3cebb723ad247ca02c19d8667063f4b4800aa155039257f4dcbf0701accf257aea8a03ef0384db5d4887f6965f7d2b10c84b3a47de9b40e

  • SSDEEP

    24576:sswE9bUix084d2mVWcaW2nrwqbqzcCnwcIcS:s1koPwxWvJfwxT

Malware Config

Targets

    • Target

      e03dae04b372e4581f8a39bd30c56b4435423c9209ea4d86dbd445faeefafd23

    • Size

      943KB

    • MD5

      a31c29394aff003f6695119188032150

    • SHA1

      5695a7e86c933e9d20b71aa8e9edb85f3c68d2b0

    • SHA256

      e03dae04b372e4581f8a39bd30c56b4435423c9209ea4d86dbd445faeefafd23

    • SHA512

      ca0e10261d6f2f0cd3cebb723ad247ca02c19d8667063f4b4800aa155039257f4dcbf0701accf257aea8a03ef0384db5d4887f6965f7d2b10c84b3a47de9b40e

    • SSDEEP

      24576:sswE9bUix084d2mVWcaW2nrwqbqzcCnwcIcS:s1koPwxWvJfwxT

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks