General

  • Target

    d92ccd7a7376ba1e89093099b7872e84ba02554e383494e937d337b0adeabd5a

  • Size

    4.0MB

  • Sample

    221105-1pnpbscchr

  • MD5

    0165da47b1ecb02af081148096c1b987

  • SHA1

    37682148a7ea1b43d5f92c0aacab911c1836c982

  • SHA256

    d92ccd7a7376ba1e89093099b7872e84ba02554e383494e937d337b0adeabd5a

  • SHA512

    ebb1c99d5cfd5f170ca5f25147fab5f9cb2df834d0d80dc2363336822d42b55aaaa89f8e1334b88f625b0c99aa6ef9fd3f17bbb922ffde1b9ae2b1c94398d9bc

  • SSDEEP

    98304:YygSfpAzW/OM5K/u0KlQxG+wALyS8G+QHNLbSJwfVRucidoi7iwzIB6h:YygCpA62M5K/u0lw+4S83uLbLRi7iwzl

Malware Config

Extracted

Family

joker

C2

https://htuzi.oss-cn-shanghai.aliyuncs.com

Targets

    • Target

      d92ccd7a7376ba1e89093099b7872e84ba02554e383494e937d337b0adeabd5a

    • Size

      4.0MB

    • MD5

      0165da47b1ecb02af081148096c1b987

    • SHA1

      37682148a7ea1b43d5f92c0aacab911c1836c982

    • SHA256

      d92ccd7a7376ba1e89093099b7872e84ba02554e383494e937d337b0adeabd5a

    • SHA512

      ebb1c99d5cfd5f170ca5f25147fab5f9cb2df834d0d80dc2363336822d42b55aaaa89f8e1334b88f625b0c99aa6ef9fd3f17bbb922ffde1b9ae2b1c94398d9bc

    • SSDEEP

      98304:YygSfpAzW/OM5K/u0KlQxG+wALyS8G+QHNLbSJwfVRucidoi7iwzIB6h:YygCpA62M5K/u0lw+4S83uLbLRi7iwzl

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks