Overview

overview

10

Static

static

0ff7d06645...37.exe

windows7-x64

5

0ff7d06645...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37

  • Size

    1.2MB

  • Sample

    221107-xr2r7adcf6

  • MD5

    0e37dbc17b52f40bec09f8e984b766f2

  • SHA1

    72ff7380dc31ec0dbbe3a08c32ae5e2268d98398

  • SHA256

    0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37

  • SHA512

    15948ead22d8bfd14712fb86a2ab6b55f766e50be5eac750c05c62c452d1efc23eeedfadebef0d4898ceadd69be3fd837450f64ade25e89e4c56f6c3b02b7869

  • SSDEEP

    12288:EaJmCEtQUKKGpOdn6HZqpR+oklRnAnvcvcx8nFGS13z81uoQb3WDb:E6mCEaiGcd6HApR92RnAsFGS13zrGDb

Score
10/10
jokerinfostealerpersistencetrojan

Malware Config

Targets

    • Target

      0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37

    • Size

      1.2MB

    • MD5

      0e37dbc17b52f40bec09f8e984b766f2

    • SHA1

      72ff7380dc31ec0dbbe3a08c32ae5e2268d98398

    • SHA256

      0ff7d06645db256a3ca9b4ec8c602240d08d9fd2c52210364a356b2a6c331e37

    • SHA512

      15948ead22d8bfd14712fb86a2ab6b55f766e50be5eac750c05c62c452d1efc23eeedfadebef0d4898ceadd69be3fd837450f64ade25e89e4c56f6c3b02b7869

    • SSDEEP

      12288:EaJmCEtQUKKGpOdn6HZqpR+oklRnAnvcvcx8nFGS13z81uoQb3WDb:E6mCEaiGcd6HApR92RnAsFGS13zrGDb

    Score
    10/10
    jokerinfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks