A file named Setup.exe compiled using .NET 10.0 NativeAOT .
The attack often begins with SEO poisoning to trick users into downloading the dropper. It then uses in-memory orchestrators and DLL sideloading to eventually deploy the Kong RAT . JOKER Setup.exe
Subscription fraud and data theft. It stealthily signs users up for premium wireless services by intercepting SMS messages to capture one-time passwords (OTPs). Key Capabilities: Stealing contact lists and device information. Reading and sending SMS messages. A file named Setup
