General

  • Target

    a8703b6c80aeea635db575dcedd78f7d61388570a283211d32b6b9c92fe30f7c

  • Size

    4.0MB

  • Sample

    221108-2gy1rsdcbp

  • MD5

    6f711498aa5613f68f13e2779887e122

  • SHA1

    5ce243ec7906e7f73edc47d4f92773a6ed782f54

  • SHA256

    a8703b6c80aeea635db575dcedd78f7d61388570a283211d32b6b9c92fe30f7c

  • SHA512

    9b934c4ccc91cf9f79511d70398974425c2cfa2a1bd4a042ce443487acf72f5caacfff548c318e766e2045ac2d766e69ac1e2efa23de886199ab17ecaa11ef10

  • SSDEEP

    98304:tJgug67CrzpFObJV0ypLd6r+DxnSQpCtlbvV0TAYP/RIBaQFIlxW0T:fgQ72cE8tDxnDpEbvVwAe/GDOlrT

Malware Config

Extracted

Family

joker

C2

https://htuzi.oss-cn-shanghai.aliyuncs.com

Targets

    • Target

      a8703b6c80aeea635db575dcedd78f7d61388570a283211d32b6b9c92fe30f7c

    • Size

      4.0MB

    • MD5

      6f711498aa5613f68f13e2779887e122

    • SHA1

      5ce243ec7906e7f73edc47d4f92773a6ed782f54

    • SHA256

      a8703b6c80aeea635db575dcedd78f7d61388570a283211d32b6b9c92fe30f7c

    • SHA512

      9b934c4ccc91cf9f79511d70398974425c2cfa2a1bd4a042ce443487acf72f5caacfff548c318e766e2045ac2d766e69ac1e2efa23de886199ab17ecaa11ef10

    • SSDEEP

      98304:tJgug67CrzpFObJV0ypLd6r+DxnSQpCtlbvV0TAYP/RIBaQFIlxW0T:fgQ72cE8tDxnDpEbvVwAe/GDOlrT

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks