General

  • Target

    56c4fa9170f338384391f229b42d8981596f4f8dfc60559a397fc98fb37c3f08

  • Size

    3.2MB

  • Sample

    221115-x9jpbsbd31

  • MD5

    d0f73b094124038ea15f28955e8cee7b

  • SHA1

    0f620bb89faf0cb11ef5f62fe29499f052ef5717

  • SHA256

    56c4fa9170f338384391f229b42d8981596f4f8dfc60559a397fc98fb37c3f08

  • SHA512

    d097e8fa9d1361f9fbbf99aeb412339181a25cdc4f63bdaaa2aaef6f4ef711aed259d96a8ff70ccbc0fb243f9d9c79f450ecdea6d3c812e06cc8b78face68d48

  • SSDEEP

    98304:+RiYlIiuxGuUFvFLkffUoLiqYdAT8O/9:+xlIhTU9FLkkoLN

Malware Config

Extracted

Family

joker

C2

http://zerowork.oss-cn-hangzhou.aliyuncs.com

Targets

    • Target

      56c4fa9170f338384391f229b42d8981596f4f8dfc60559a397fc98fb37c3f08

    • Size

      3.2MB

    • MD5

      d0f73b094124038ea15f28955e8cee7b

    • SHA1

      0f620bb89faf0cb11ef5f62fe29499f052ef5717

    • SHA256

      56c4fa9170f338384391f229b42d8981596f4f8dfc60559a397fc98fb37c3f08

    • SHA512

      d097e8fa9d1361f9fbbf99aeb412339181a25cdc4f63bdaaa2aaef6f4ef711aed259d96a8ff70ccbc0fb243f9d9c79f450ecdea6d3c812e06cc8b78face68d48

    • SSDEEP

      98304:+RiYlIiuxGuUFvFLkffUoLiqYdAT8O/9:+xlIhTU9FLkkoLN

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v6

Tasks