joker | bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c | Triage

Submit
Reports

Overview

overview

Static

static

8

bc2a85617d...6c.exe

windows7-x64

bc2a85617d...6c.exe

windows10-2004-x64

8

Sharing

General

Target

bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c
Size

617KB
Sample

221108-1q7tlacbar
MD5

0e8fb5ec5566befa08c757351491cb70
SHA1

236c310aa65f46e8b41111d83774e4339dd0fcac
SHA256

bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c
SHA512

fcb58f9eb1f2d41826e7307b25f601eefbb6a00e8152dae8ec7beed2b379c864040fb9222adcb12dc7564979af6a03002a765ccdb61bccebbc4feed3eb41468e
SSDEEP

12288:XlQzsQQ+Cq7PQVHV63VXT4d0lyxuHUsrskfeabs:VQQQZt4V16lXkdP7UskGQs

Score

10^/10

joker aspackv2 infostealer persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c.exe

Resource

win7-20220812-en

joker aspackv2 infostealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c.exe

Resource

win10v2004-20220812-en

aspackv2 persistence

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c
- Size
  
  617KB
- MD5
  
  0e8fb5ec5566befa08c757351491cb70
- SHA1
  
  236c310aa65f46e8b41111d83774e4339dd0fcac
- SHA256
  
  bc2a85617df8b07e9e8627986ae7ff57e92ed1b134de91fcd6ec6e9e86da7b6c
- SHA512
  
  fcb58f9eb1f2d41826e7307b25f601eefbb6a00e8152dae8ec7beed2b379c864040fb9222adcb12dc7564979af6a03002a765ccdb61bccebbc4feed3eb41468e
- SSDEEP
  
  12288:XlQzsQQ+Cq7PQVHV63VXT4d0lyxuHUsrskfeabs:VQQQZt4V16lXkdP7UskGQs
Score

10^/10

joker aspackv2 infostealer trojan persistence
- joker
  Joker is an Android malware that targets billing and SMS fraud.
  infostealer trojan joker
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

jokeraspackv2infostealertrojan

behavioral2

aspackv2persistence

© 2018-2025

Terms | Privacy