joker | bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3 | Triage

Submit
Reports

Overview

overview

Static

static

8

bfdfd015ca...e3.exe

windows7-x64

bfdfd015ca...e3.exe

windows10-2004-x64

8

Sharing

General

Target

bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3
Size

829KB
Sample

221108-1nyg5sadc5
MD5

0b835d9a77cd422b7e5914c8b964e3a0
SHA1

3d06fecc6e7d428d23a52ac487d2f3616f38174c
SHA256

bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3
SHA512

5db0b80abe7f2bed42f32f96b5608228c76f53b9a2e9cb63b01bce2912bfbd82de441a9643d79da54207f8ec4386c0c0b6018020db0c375f4d556bb6458023ee
SSDEEP

12288:R2oyM3bYl9sGKVCQVW5Y24coyuWRzQtL+4vl5f1MLUQDkZbdv/fcqjySA5t8MQ2p:R+M0laGxruWxQh+1UQDkZt/EExMFp

Score

10^/10

joker aspackv2 infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3.exe

Resource

win7-20220812-en

joker aspackv2 infostealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3.exe

Resource

win10v2004-20220812-en

aspackv2 persistence

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3
- Size
  
  829KB
- MD5
  
  0b835d9a77cd422b7e5914c8b964e3a0
- SHA1
  
  3d06fecc6e7d428d23a52ac487d2f3616f38174c
- SHA256
  
  bfdfd015cadb203cfb8d76017e040614100c322cb70791df53be2faef1aef5e3
- SHA512
  
  5db0b80abe7f2bed42f32f96b5608228c76f53b9a2e9cb63b01bce2912bfbd82de441a9643d79da54207f8ec4386c0c0b6018020db0c375f4d556bb6458023ee
- SSDEEP
  
  12288:R2oyM3bYl9sGKVCQVW5Y24coyuWRzQtL+4vl5f1MLUQDkZbdv/fcqjySA5t8MQ2p:R+M0laGxruWxQh+1UQDkZt/EExMFp
Score

10^/10

joker aspackv2 infostealer trojan persistence
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jokeraspackv2infostealertrojan

behavioral2

aspackv2persistence

© 2018-2025

Terms | Privacy