Extracted

• • Target

    8ffd741c68f8c90e56893e5e7971b410f03eadb85e556bd3b64cab5bc648f506

  • Size

    26KB

  • MD5

    40b8cca2ae2c6066bfbef8ce0803c8c0

  • SHA1

    7375081504060e4c044ad664b3581370f335a2d3

  • SHA256

    8ffd741c68f8c90e56893e5e7971b410f03eadb85e556bd3b64cab5bc648f506

  • SHA512

    7c02081c747e9ebdbc12dad69e74fee87ec3cac685ed5f2b5ce642eca6fa51a926dbfb587d7c316d1cf8da2883f3382a3b41f331c33fd8839a33d005b18d252f

  • SSDEEP

    384:rfNhPbj62Tj9xec1JmLfBY5vX0kdaqj0eohDTkVOhvF27z/FUxiWtBlwmRz:rbm2Tbar+f0UaqC9yoYf

  Score

  10^/10

  jokerdiscoveryinfostealerpersistencetrojanupx

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Sets file execution options in registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2