Extracted

• • Target

    5a75fa55211464cb6938bcc10ef921422b81d3fa1e864897bc15dcd96ab57e1b

  • Size

    32KB

  • MD5

    0387eb52d9a0ba82e69b623d14425550

  • SHA1

    a20fa675abe285070999b9830decf78b81a3896e

  • SHA256

    5a75fa55211464cb6938bcc10ef921422b81d3fa1e864897bc15dcd96ab57e1b

  • SHA512

    e62309af8828648883a37abaa22828c253c90fb2ad4e0d8d86e2021e648cf070b27905c53a9e12d3e8511581bd9dcd7e742f4bb0277572743eb3bfbb0895b8fd

  • SSDEEP

    768:ryHus/t/jPMUY96cPvc0xJGKJxsLoI/CYR/9m:rm7/1T46Gc0xJwdL

  Score

  10^/10

  jokerbootkitinfostealerpersistencetrojan

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2