JokerMalware
Joker is one of the most well-known malware families on Android devices. It manages to take advantage of Google’s official app store with the help of its trail signatures which includes updating the virus’s code, execution process, and payload-retrieval techniques.From MISP Galaxy
Last reported 1 month ago, by CERT Polska4 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“While analyzing the network of fake shops masquerading as Unicc, Group-IB Threat Intelligence analysts detected a total of 21 cryptocurrency wallets for various currencies.”
- T1684Social Engineering
“… identities, bypass identity verification processes, file fraudulent tax or government benefit claims, and support highly targeted social engineering campaigns.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Inside a multi stage toll fraud operation targeting Poland“Our earlier analysis of Joker described an android malware family which abused carrier billing.”
-
Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs“Its emergence coincided with the shutdown of several prominent carding and PII marketplaces, including Joker's Stash and SSNDOB Marketplace, suggesting that Bankomat sought to capitalize on the resulting gap by combining identity data sales with traditional carding services.”
-
US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks“Most ($15.5m) of the funds are found in 10 addresses linked to Keyvan Fayaz (aka Achilles, The Joker, and bc.monster), which suggests “he may have acted as a treasury of sorts for Mabna's hacking-for-hire operations,” TRM Labs claimed.”
-
Cannibal Carders“…s discovered) includes more than 3,000 domain names, many of which are copies of some of the most popular underground card shops such as Joker’s Stash, BriansClub, Uniсс, Ferum shop, and ValidCC.”
Indicators in its reports
named in the reports above- wwh-club[.]netin 1 report
- unicc[.]cmin 1 report
- briansclub[.]ruin 1 report
- altenens[.]orgin 1 report
- crdclub[.]wsin 1 report
- carder[.]ukin 1 report
- sky-fraud[.]ruin 1 report
- fl.l33t[.]suin 1 report
- unicc[.]cxin 1 report
- jstashbazar[.]comin 1 report
- briansclub[.]storein 1 report
- briansclub[.]shopin 1 report
- briansclub[.]mein 1 report
- jokerstash[.]ccin 1 report
- unicc[.]mein 1 report
- cvv2me[.]comin 1 report
- cryptonshops[.]comin 1 report
- 104.21.52[.]20in 1 report
- 172.67.194[.]75in 1 report
- monerdomen[.]ruin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.