Extracted

• • Target

    62540809831ac4f0c48cb25cc71d0837

  • Size

    2.0MB

  • MD5

    62540809831ac4f0c48cb25cc71d0837

  • SHA1

    217e3ba4ddf575b5eefe85c7fe680098e10343ec

  • SHA256

    c39c246ebb7f5386f1733f16f87cfff43e44b443ac3bcefab807dc2268ea6788

  • SHA512

    2fc0c84a752b173797d757166a07b51322f24f260d0153fc4eebc7330b4cecddd564dc9dc0385961a2dd68e3dfdcc5aa8e112e96a1541d1162cadf6381671fdf

  • SSDEEP

    49152:nnsHyjtk2MYC5GD/QwtUEB4WdXLLs8BE4c1yU:nnsmtk2aTwtXDHxE4qyU

  Score

  10^/10

  jokerinfostealerpersistencetrojanupxbootkit

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2