Analysis
-
max time kernel
2836426s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
24-11-2022 10:52
Static task
static1
Behavioral task
behavioral1
Sample
Mask Photo Editor_6.6.3.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral2
Sample
Mask Photo Editor_6.6.3.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
Mask Photo Editor_6.6.3.apk
Resource
android-x86-arm-20220823-en
General
-
Target
Mask Photo Editor_6.6.3.apk
-
Size
23.2MB
-
MD5
624cb7c78da4d9ba0138d3c543bec4e7
-
SHA1
223308638b58e2baf1f5de9dc6551c999b6788e3
-
SHA256
7385e0e3d811b317ed67eefb54274b232c1f167de14c593688453b7431034a02
-
SHA512
8396da9e7d896f5e0d2b16515184a51a84db767837e379a23037637ebada464915bb0665db4fb867f4a4f93515daa175308e7ce08bc7e76012ecfe002f4a893f
-
SSDEEP
393216:M+SIiydEfvNKIsun8JfiwI84QZePw21XGZOvwaebxS6pxCQsFZBE:0IdaNKIEJfk84Dl1XqOvdebrpqw
Malware Config
Extracted
joker
http://careof.oss-ap-northeast-2.aliyuncs.com/way
https://cxjus.oss-ap-southeast-1.aliyuncs.com/af2
https://cxjus.oss-ap-southeast-1.aliyuncs.com/fbhx
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Checks Android system properties for emulator presence. 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.mask.photo.camera.editor -
Loads dropped Dex/Jar 5 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process Anonymous-DexFile@0xe55ae000-0xe55af3f0 4163 com.mask.photo.camera.editor /data/user/0/com.mask.photo.camera.editor/files/entrust 4163 com.mask.photo.camera.editor /data/user/0/com.mask.photo.camera.editor/cache/1598581401714.jar 4424 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mask.photo.camera.editor/cache/1598581401714.jar --output-vdex-fd=93 --oat-fd=94 --oat-location=/data/user/0/com.mask.photo.camera.editor/cache/oat/x86/1598581401714.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.mask.photo.camera.editor/cache/1598581401714.jar 4163 com.mask.photo.camera.editor /data/user/0/com.mask.photo.camera.editor/files/ionsxg 4163 com.mask.photo.camera.editor -
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.mask.photo.camera.editor
Processes
-
com.mask.photo.camera.editor1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4163 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mask.photo.camera.editor/cache/1598581401714.jar --output-vdex-fd=93 --oat-fd=94 --oat-location=/data/user/0/com.mask.photo.camera.editor/cache/oat/x86/1598581401714.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4424
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5cb7543c4df600f2af58097cce0e334ba
SHA183cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA25664c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980
-
Filesize
1KB
MD53932c54b50e5382e022677dd9afaec6b
SHA1044267da4b56ddff86d1c55d3db4fc6eddde17f8
SHA25645d0899d78555f51708a842ee962aa957862cb25311aeaebc4da54657c57ddac
SHA512e501a2001d8db9073e129800e65abd58545e425709dafeb5a397965dcc660cafbbb16b20bd1c50ff4467f585e17440d65f5bd06e5044cf24f07948a417291553
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD539a22da81abd6bbc5019dc9742b89125
SHA1ceed6779eb13be7becca6388890f03ce9a2b73ce
SHA2568ff31580e53a4cb6d355fef075b66b96df706ca521a8230b540d35d3ab6cbbe0
SHA5123c90b4101d3719ba7d9cac84b12f084d9cb552e2d0d4a76d19209fb4a88704346e38056e0a5960e9937fa13e1c539057a08e2c77b3f7af10f91aacaa3addb46d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
497B
MD5046d4dde56ab75338cb6daa24cafc4c6
SHA170fe7e819250933fd4baa9d8bdf4e8aebcd4884f
SHA25649f6810f6a10be7210552f9991249c7c5d3e73eb56129e75e49374e28dd09f00
SHA5122e28c50f46a64780c373d9e474cbbf09d208f59927bd239f55eb79bdc06025f979cd0031539e606ee718a76384cbcd07a835d22d0997a1d04f29b42e9bec9fbf
-
Filesize
70B
MD560a745aa239a58b6a3c070ac7181d9c2
SHA1824ccf92297cc4c5fdefd69f7463b2c70211c5df
SHA2569f08c976904e8063b25d7779f61248d97780619d608909c74ad99b66baeefba0
SHA512dd7baba3bcec646f33ce3720762c795f283feafc2caec95e5bd87b620254c82c6c458c537a614853ac9e5e8b5321b9294a1f5e36383dfb64b5aed629aa9e6729
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD51565e42c355b0393baed82b3aa60269e
SHA1cd044257131a8e6773d57fd337e092792c7aa854
SHA2569c7fe6f48e559d72229edc3693e2e9667145fa296273460f074e51409e9909dc
SHA512bdc445eeacccaa12cf16290cc9193e6ac4a5c46f224f7754ed345a2df90ba6c489123388e95ff4afc615d26207a3c71120a7d9aa5ca1feff09539540253eef86
-
Filesize
36B
MD56809488f4847f9e33851be137e704d9b
SHA15285457166a7fe27cbf5e5a46cc56474d878230e
SHA256262eb7fc438e99a4aa26e069e97dee635f1afc83cec1a2a4dea6711ea252ea79
SHA5123dbb5d50121fbe8d5953b1c9294a9e361e43771d3bf0c3b15f025613796357848a57bb54e5c66f69d968279285aa60f2944d4090eea5970861064cf3d2187006
-
Filesize
19KB
MD51ced7d2175dffa49a034973977306116
SHA13f8200a08b62466017e817605c5386b31bd7810d
SHA256ab58700e1e6ebd3427baac6356ac257a9e5d4b51119132b6bb2c9591355ae98d
SHA512b0e9791e2cd69962a0b5e64a77c6cbe932b2e4f205a533ee551b68968c702d35c52cfeddecf743b497e6058c0884124e3dfd3d9a471d0774eb7ae7046d8c63b7
-
Filesize
19KB
MD5cf2ed89992c1145a27f078b9da17e96c
SHA12afc75b5bc6329198ec01829e6c6acbd0c0dee01
SHA25684009ae4f9125e2d61a670b88e41ad81bba2161dc0910b4506ef6356f0ebeb78
SHA5128240cd4dcf4087b5f02400853f6820afe4b2a8825089aaa661662539fcb857b78013f8f3a9dc047034f6f42168fffcc6c1727076ab0e4eeaffcad956659de6f5
-
Filesize
144KB
MD53704a173599babdfc3851f8b76c5436e
SHA14ef588e9495bad53eb0d2553b761944f13b3bc46
SHA2565873fb51869e5ab4329023adbcdc9b866fc384620f4d40ff94c06a29dc6a51c8
SHA512621e9b2ab278d501b479ff95b7e50af70238b93b52549149660d55e097d5dbf49873d33930468f0fe4979d43a94cd03cebbefab16b51fbcf6f4167742b034056
-
Filesize
178B
MD586be3bb7cd096f516b9b61539926ac85
SHA1dc34e34a32d22a767acf8405bd1b83dc457d547e
SHA25615554b3fabfc74f12dcfdf90443c0db25b2614bc33370f856af5c8e613ea1d5a
SHA5124ef03ff58e53831a44c26f9ed544dc76911a568029a19c65ec3a482de8457ee38f4ab273fc4f7bb2e96dc9fa9f48163cd31f8b9aadaf4d51e1352e66104eaae9
-
Filesize
6KB
MD5fa7aac53dc2cb64f5711083851b6a445
SHA1b75fe6bccb8d7c4638181680c1c41a6bf4c3b787
SHA256c2f85d19488a85b9485233742317ee083b447b607b2904b61004688eeae1239b
SHA5127f449a49c8214a02f01c0bf04646b318c799f5c95f225b9b3ecbea4d0b9720baef89f04b3bb3952ccd9ac79940a3f2bb93e0f8c606ad72b72b982e4c652361d6
-
Filesize
6KB
MD52d089c04fcf4550ef765de37fa8017e7
SHA13ce476f45779fe0dcf21165d860f180ba46b1c1e
SHA256a493238d10260eacceb75cc819b4ea3386b873a63f0f4a07826bcd1d9a3e5e89
SHA5126505c29968532f4de8984a055bb5f2ed88eb933c1248d15eaf440a5942aa18a310a200195dfd90659eab566565fc4020d9f2054882c91d26c527a0ae74aa8983
-
Filesize
22KB
MD51c41ab681c13a4edba69c0acb134f33e
SHA14b83ccdf0aad99c7dc7ab81e099da7d8be0abdc4
SHA25627eac07d6f416f55e75a195766565b57d05497bbaeb7d7b27ad85a841e62414c
SHA512342d88d6ecd7805548849b08003f1cebcbbb767b47cd2c25e24dab10d0010da14c76dfb445252236d05031d3e9de3608431bab49991af37bedeb896125692ede
-
Filesize
141B
MD59c03c3fddd82861760a5276a868e9a4c
SHA18d1512ec96fbdd6ccdbb4ecf52b0cca59b9335e7
SHA25636f6d9e84172c7ea8aaaeac3d7b85bdc126de80003becb4b18d770584d91719e
SHA5125f034a15a516762eff1e93a5eb9cad45b7cb63726cf9260324a4c055686e1654cd14925249e00c8f3d44c101a91a6231e6d447c05e34f224ffda21db7503c12c
-
Filesize
6KB
MD5acf674ffedd8e28e46001730312ce172
SHA134004364c06cf5d0d136abc789153abc79b3ff53
SHA2562da1f78c6762d1e22e8ab9ac53a67ec18f01a26709c1ec560bef6a14fe8e1d43
SHA5122c25cf8209544add581c6e6b266cf7688a8bfcb5cac14ba6e4adbd21307426f051d358a5f53b2ccabdcae94f10a8f45e1da2624dcecce126c81e131330fbae17
-
Filesize
123KB
MD5ebc43acbd2b99547ad6cd08432b92f3e
SHA1a8a100643005f5822a762899f6086f316e399678
SHA25649c94b96234249807259e76eb02bbe67c0b428c1473b0d2de76f67ab17217015
SHA5124fe33ba3b4999fa4c490f4d290bdaf84f280a6ff839d03ee32d39571dc18cc55ed3e705114661aef68a74a17da99d6f606b867e3977815198e93e732901f1db5
-
Filesize
196B
MD5d05ffdccaed8cd6840d54ea433cd83dd
SHA1d02b4ecd6296a585be6673b6c16b4c5ba1afcda2
SHA256a6b951496f1e7825356c306f46a8beeaeca0c3ed5e717dc7f77b1d2bff285040
SHA5121e3e879e7aa0874e5cd523d2a8a9f4de41abb185e4d6616e4e00bae127caddbb7c5e7b592ed4a40a747e5a1fe7e5daf8144ea06c99157e9d814540b1dea1d827
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
72B
MD5976cdd080797ad3c6b1a8663d6430fce
SHA1aa22dafceeeffde0cc4b18c6abacb4331664bb35
SHA256a3d684960b6f5b8ce83f5565f3d02feef89df300d7616c01132ce6cea15bb5be
SHA5121018c0444726d09962d3ae1a4be7d46d7857748f32b0fdec6f3b8aa994ae2c8d7e864220732a48d18c29f4078859f0559191b83ae79c011fbde71d12de5d83ed
-
Filesize
192B
MD561ecf4bbcd6f52c850a00ba9fce9fbd8
SHA1dcfa242957ff39b6962a4233de8f1d11f6731899
SHA2560e689e417810a5080c781116da9212fb074a8d22abe7cf9d145cf404c9dc0f3c
SHA51245edec2953fa584980dd50d2417a8e99d6df10646d059c1e3f5b13f914d6352625ef7b41f8c4a2d6ad7658b913b6a923c314f9ed043fd32af7b47fbb9fb0f2ce
-
Filesize
9KB
MD545e28de01053f2e2e3da852905aeef8f
SHA14d77692a8be2d03dadd889fbb1e3b22f9c68b714
SHA2564ab3afd2efe58b5e910693277be491023a2b75c368b56fcbbaef7636d27d09dd
SHA5125c0a6512d241c956c9f1c4e74f92e23aaf7179f2af9712763056075e35727462b5a38b9435b508e0c5dddae3e763d49ff69b7d3005e9a67da11baf194b25f821
-
Filesize
16KB
MD50ad6fea1f5017f9cf4e6dbddc0f5ef97
SHA11788223fd6d24afcc0b0d856aa56bd92f84b41eb
SHA25672dad360219d07c162178d356d4bed1ce527100e2c090a637754ffa014f5ea6b
SHA5120c0c5f2c6ecea4ade1ea09ec159757aba432f86f1dc3325667b374ad0c8a5ba21f46746003c615b075a915a8e1d7bf41bc7fa6afa6dafa638f2b12b37515d32c
-
Filesize
21KB
MD5df63f85b7c5506c22afabc5980079c96
SHA17f1701c8ad372955f25405d45f340ae31b35d256
SHA256a64ba8f89b414e889d2ecca4f8dc0dee47984f0586fd8af2a073782975851665
SHA512ea7272552f5b2750421d195bc9982d14dbadb3fa8b45d3d1cb5c6cb979a89de7c158e3acd00d058c1fb4171f2699c4b57abd0d95e1e6cccd99cd9d3eb14c5f75
-
Filesize
43KB
MD53d13a1c2d90322301122f0f451ec5d3c
SHA18e71493581e05a62efb633197fa5a6709c7fde1d
SHA2562fc36a3881ab97d214092a47cb9217871a3536ed3d8d542c74e64b4c6135e488
SHA512f7f9a054ea819c38a5c8a3835c84a20b6364c7d3c5968f61c0d96b8d338038ad381a8df82146e1f660b455ed7828e9839ce3b3a43ad176ac2022406c86bb1089
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
524B
MD56f0b33b5715c28eb174c4338f5d99637
SHA11bc5ee7c55dcb668617cc560e3ea6af7de3b6151
SHA256c62efb50024d8d0477359475f1b48fba97695fbbae001a0ac40575e7f427cc13
SHA5127734ee0346b241a9e7239227ecd69d2977e37dca53adb776fa88dad96d8b4f3c41151f0fa47e88fd4339a92501cd1851292afb4e4d9421ec72d8f1df5974308e
-
Filesize
8B
MD57dea362b3fac8e00956a4952a3d4f474
SHA105fe405753166f125559e7c9ac558654f107c7e9
SHA256af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA5121b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
-
Filesize
108KB
MD5a68bda1580f52e9f5d9b036ae604755a
SHA16e25305a95d87ccaba80cb855920bbad8a31ffd4
SHA25676ef1ea778fd924cedf63e9ffe11326c8f4b45ce5a964aa56cdc8f1850e172dd
SHA512d40bd1578fe3a027627c41352ba6fd1e662067db328aaa7b8c732285b8f923e3b15b9f3583a5c6737ba8304659d706688ea70417a0197409f65bf54780e8c449
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
Filesize
133B
MD5f2391b206cf5eaa2aae7e749da4f87bd
SHA1a4237dc4cb45ffa484f88af6d7e9d81247082376
SHA256c34c37aebe64b68d186c8d954027a0f456c990ed38c44d18020b1c540541f226
SHA5128500736db70511215ac1919911e58811d7c12aff57cc391c67c3a190b032cb0e4c098cfb026207b455629f377ed730b0095490349f6edf36abf3ba5dab09a095
-
Filesize
257B
MD56496a98513b2b3c9f853243c5af041ed
SHA12d256fe7dfa940a9bffe2c44041e80c000e99bfa
SHA2560bcee532ad3210e507c133a2905b851e34ec8fb865f92262d03a515cb6c4cdc1
SHA512554592e7d2e965c6dd29f1026564ace4504683dcee2810bc3c525bf9998a83d4241ecc8e05b295c09823da4da1e4bbd5382850ed13b854b8ed52b3fbc45cb768
-
Filesize
257B
MD5963e69bae8319678326c815d6096b983
SHA197c1b704851db733440d5606702cdc3cee0db02d
SHA2561fb4e802de5cfd56b086fd86e148a497229332a98c09955eac1d9dbd88e1719b
SHA51290428f6fedc18b8fd696b00d9780097ef6af64b8232681c9663b510dca89e74b8266021af9bb021d1c27594a917b66b138f54681113ec7854ca9d7fc529b2388
-
Filesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
Filesize
4KB
MD5d1e6b3dac82d7e6fac4e9001ef550fc0
SHA1b6cd9741cc254d3b7f4e9ad0baaf9b5596c308c9
SHA256aebeeec82797dfb01788fefb2fdfc32fa7876463d2048018c032f3f921aa5800
SHA51208ea24482be0991e11aa102f6cf79e29b400e960bf6e9f77960d3d4e0da8d18bb948bb2e6b03bffa2e7aef35ea079737b68609f479a9c075d1ad9ccedd6a17e9