jokerransom | 79ee8d39960b8bef040fa2311f0f57b33040c429c4b79ae643df07cd44726e1a

General

Target
JokerRansom.bin.exe
Size 1.3MB
Sample260706-pzenmaft7y
SHA256 79ee8d39960b8bef040fa2311f0f57b33040c429c4b79ae643df07cd44726e1a
MD5 3ba978766aa2548c763e33efb77ce263
SHA1 41859b97093ab52d264233c0f01e857054b0aea5
SHA512 e2e6165bfdf5b41b2cda83e36edb19874c7bbcca98821796d44c72d2d426bb9e57d39e9fd13b14817c01f2d907ae9f9840cb9112addd6ab5aac5416d18ac19f0
SSDEEP 24576:i9BrMRmJkcoQricOIQxiZY1iaDkfGrMZbMwx3YVbedXwhPbnzdcMpd:itJZoQrbTFZY1iaDkfGrMNYBedcTzd5
TLSH
T15255E122F5C58076C2B326B09D7FF769963D79360336D29B37C82D212EA05816B39763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  JokerRansom.bin.exe
- Size 1.3MB
- SHA256 79ee8d39960b8bef040fa2311f0f57b33040c429c4b79ae643df07cd44726e1a
- MD5 3ba978766aa2548c763e33efb77ce263
- SHA1 41859b97093ab52d264233c0f01e857054b0aea5
- SHA512 e2e6165bfdf5b41b2cda83e36edb19874c7bbcca98821796d44c72d2d426bb9e57d39e9fd13b14817c01f2d907ae9f9840cb9112addd6ab5aac5416d18ac19f0
- SSDEEP 24576:i9BrMRmJkcoQricOIQxiZY1iaDkfGrMZbMwx3YVbedXwhPbnzdcMpd:itJZoQrbTFZY1iaDkfGrMNYBedcTzd5
- TLSH
  T15255E122F5C58076C2B326B09D7FF769963D79360336D29B37C82D212EA05816B39763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution jokerransom persistence ransomware
- Detects JokerRansom ransomware
- Family: JokerRansom
  JokerRansom is a Windows ransomware written in C#.
  ransomware jokerransom
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Sets desktop wallpaper using registry
  ransomware
behavioral1