General

  • Target

    ac64af32d1a865c03ade6dfd7ce0787b2f1db51fae16020168d5f48e3823e14f

  • Size

    46KB

  • Sample

    221106-qvwl1sdfc9

  • MD5

    080ec93c00dfbbacf60a59eebb55803d

  • SHA1

    0153848c149f909205bfda63ec094c0fe013096f

  • SHA256

    ac64af32d1a865c03ade6dfd7ce0787b2f1db51fae16020168d5f48e3823e14f

  • SHA512

    20be23706b6148fa8bb2724ce1ab10239cf45978300b74a642ad43b680fec629ab6d21204a8fb28060eb6ad85510f76952763350eb416d07771ddf6a3be17c22

  • SSDEEP

    768:+GCV6OOVTEQynyk40FO9P9ZgKRuON91o/spL4OH8:kV/O5s40mlZgK8wg/GLxH8

Malware Config

Targets

    • Target

      ac64af32d1a865c03ade6dfd7ce0787b2f1db51fae16020168d5f48e3823e14f

    • Size

      46KB

    • MD5

      080ec93c00dfbbacf60a59eebb55803d

    • SHA1

      0153848c149f909205bfda63ec094c0fe013096f

    • SHA256

      ac64af32d1a865c03ade6dfd7ce0787b2f1db51fae16020168d5f48e3823e14f

    • SHA512

      20be23706b6148fa8bb2724ce1ab10239cf45978300b74a642ad43b680fec629ab6d21204a8fb28060eb6ad85510f76952763350eb416d07771ddf6a3be17c22

    • SSDEEP

      768:+GCV6OOVTEQynyk40FO9P9ZgKRuON91o/spL4OH8:kV/O5s40mlZgK8wg/GLxH8

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks