Resubmissions

12-12-2022 10:57

221212-m18xradh5t 10

General

  • Target

    Paint Art.apk

  • Size

    3.5MB

  • Sample

    221212-m18xradh5t

  • MD5

    16a4cbdb16994f328003f63a8b16a1ab

  • SHA1

    87b027fa2a3bf188d5945720bc16dc1f9469cf77

  • SHA256

    e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593

  • SHA512

    09eaf20e4b27f012a2458fcd875db02eff6d500b9ef2d9c1a0b073591cef6d86f4a5e648e0dedc29c64b11d6a846cf27806972c0438f5eeba44e52c9b19b010f

  • SSDEEP

    98304:QrSSze0+HVciXp0wxsPgdsuGnRCCO+8Lz31JuhVEraCZRgqk:USSi0wciXp0w2JxRe+8H31QjO1k

Malware Config

Extracted

Family

joker

C2

http://thoroughly.oss-ap-southeast-5.aliyuncs.com/artpainting

Grant permission to use all features

https://cxjus.oss-ap-southeast-1.aliyuncs.com/af2

https://cxjus.oss-ap-southeast-1.aliyuncs.com/fbhx

Targets

    • Target

      Paint Art.apk

    • Size

      3.5MB

    • MD5

      16a4cbdb16994f328003f63a8b16a1ab

    • SHA1

      87b027fa2a3bf188d5945720bc16dc1f9469cf77

    • SHA256

      e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593

    • SHA512

      09eaf20e4b27f012a2458fcd875db02eff6d500b9ef2d9c1a0b073591cef6d86f4a5e648e0dedc29c64b11d6a846cf27806972c0438f5eeba44e52c9b19b010f

    • SSDEEP

      98304:QrSSze0+HVciXp0wxsPgdsuGnRCCO+8Lz31JuhVEraCZRgqk:USSi0wciXp0w2JxRe+8H31QjO1k

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks