General

  • Target
    0549f986d407ef60f55524c3d27b2b72f16038fb0cc13c27aabdde2fb3b3f9e2
  • Size 4.0MB
  • Sample221107-3fsm2aeef6
  • SHA256 0549f986d407ef60f55524c3d27b2b72f16038fb0cc13c27aabdde2fb3b3f9e2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • joker

C2
  • https://htuzi.oss-cn-shanghai.aliyuncs.com

Targets

    • Target
      0549f986d407ef60f55524c3d27b2b72f16038fb0cc13c27aabdde2fb3b3f9e2
    • Size 4.0MB
    • SHA256 0549f986d407ef60f55524c3d27b2b72f16038fb0cc13c27aabdde2fb3b3f9e2
    • MD5 SHA1 SHA512 SSDEEP
    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks