Extracted

• • Target

    60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3

  • Size

    26KB

  • MD5

    4ad83b7f8b9a684e39696c4909451630

  • SHA1

    68291da4bc62f793bedd5fc61be23d8f5f532975

  • SHA256

    60595c19a11e39ca8444dce56f6db1f8c79356db3cb9d314893c14c494f9f9d3

  • SHA512

    38462aeac1c1dc88953596964f8accb424994f6cbf4177f33f75c41b1ea0d335e2a3d2cb849f66b2d8297e4271a3628dce0c59010745c7a123151811926c1532

  • SSDEEP

    384:rK5Iu0DOSiBuMAjo/BNxf+yOhmwnh2Oj0eohDTkVOhvF27z/FUxiWtBlwmRz:rK5JAyg9oNVo2OC9yoYf

  Score

  10^/10

  jokerbootkitdiscoveryinfostealerpersistencetrojanupx

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2