Resubmissions
12-12-2022 10:57
221212-m18xradh5t 10Analysis
-
max time kernel
100493s -
max time network
168s -
platform
android_x64 -
resource
android-x64-20220823-en -
resource tags
androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system -
submitted
12-12-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
Paint Art.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Paint Art.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
Paint Art.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
Paint Art.apk
-
Size
3.5MB
-
MD5
16a4cbdb16994f328003f63a8b16a1ab
-
SHA1
87b027fa2a3bf188d5945720bc16dc1f9469cf77
-
SHA256
e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593
-
SHA512
09eaf20e4b27f012a2458fcd875db02eff6d500b9ef2d9c1a0b073591cef6d86f4a5e648e0dedc29c64b11d6a846cf27806972c0438f5eeba44e52c9b19b010f
-
SSDEEP
98304:QrSSze0+HVciXp0wxsPgdsuGnRCCO+8Lz31JuhVEraCZRgqk:USSi0wciXp0w2JxRe+8H31QjO1k
Malware Config
Extracted
joker
http://thoroughly.oss-ap-southeast-5.aliyuncs.com/artpainting
Grant permission to use all features
https://cxjus.oss-ap-southeast-1.aliyuncs.com/af2
https://cxjus.oss-ap-southeast-1.aliyuncs.com/fbhx
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.nuklis.artpainting/cache/1633031840514.jar 4757 com.nuklis.artpainting /data/user/0/com.nuklis.artpainting/[email protected] 4757 com.nuklis.artpainting /data/user/0/com.nuklis.artpainting/files/vitality 4757 com.nuklis.artpainting /data/user/0/com.nuklis.artpainting/files/ionsxg 4757 com.nuklis.artpainting -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.nuklis.artpainting
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.nuklis.artpainting/[email protected]
Filesize5KB
MD5cf11925fbd5e7de3cc30bff793d2d362
SHA12f10f00a4914ecb9ef31842f4a22041948570aab
SHA25613afafb20e8cdc06b1b747665e024bce9fd3efdf9a5debb7a853b61ef4bf540a
SHA5126737dbe5a2f5c72f7d4fab9c04dc52756b917303cd909aa20be9cdd268c8d08187f5a2b7eaebf8f6af1024617c15821d90fbef927bf980eb6acf7e62713a2f60
-
Filesize
64KB
MD59b23e6a88d5a95f155f205cb04b93cd0
SHA1b62dccbbef087a0731f226b96d15d35d8aa5e5fc
SHA256f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857
SHA512bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482
-
Filesize
1KB
MD5877d8db6ff19b088c62f6483fdf80346
SHA15b2e83408f0174b0d563dde278afb8aded66b598
SHA2568bb18840a166f696aba47f18f7974ac413cabd0c9b55fc880e813ca4804528dd
SHA512e1341a7c668c46063b4ec81bc72491c27e7c53cc13118d0b3794ee87652c0dc12520d74a499c2481e9c07b7a59f6127a6ddb88b265ad90a328ed574c0fb96ee7
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD5ed4ee5c958488912198a79258aeeb619
SHA1c085c1dc8afd6e9df44b3f107683fc70c8679554
SHA2568ebf1252366119bf3f8201c5a5d661437402890ca3ffc0b110359970be708fa2
SHA512dcdc3f9f0ad85ed1bcc7ac73d06b6813489dd251e8fb52ea7c5b231dc4e7381be8455f1c1bbedb36670b5338f90fe49661dbf9b715de6a2b736a2a6c5f2346ae
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
496B
MD5754551e54e855be8f1b63584476f0d52
SHA1256636aa1d127ea84f651e1e3559c9a623ac6c7c
SHA2565bd69f035dc984d27ddad94f6ac414f325b8d509127448d360af420fbcd530f0
SHA512beb7c92fa79925968d0bba72a917672ae7cba56281f04b801a501981251d40f69c997ed5559b3d4c27a85c14fd63da37bbabfeb2379fc9795246146ef792ca72
-
Filesize
70B
MD5fd9e51800f6e4f6013b7f4610901dc09
SHA1d90799c6a8a7e8f062b1b30a54ce41b7129c9b92
SHA256ea397ff1b41f1842a14a75fffe5b9af00a905651193aa89d7b880c455b3c1d54
SHA512b03d6c381c0d643f9b71e0670da64567f7315b1502a3790d8b7d675ef390a55eda1e74cf9c6069ef87b9809bebd801e1522ca8e210a6db284140b41be0c65812
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
112KB
MD5b663831f8cc130493476d94f2d7a5330
SHA1043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16
-
Filesize
1KB
MD57319324e1e087ea49f0ee630687fd7a0
SHA18ce8aef9b9e72315dcc2a81c258c04314b3ad320
SHA2562ea9e95496cee189c0f9a9844dc9e1cc43fafbec0c2ec7e6922a633efb6d0717
SHA51227c66b1c2c2679214953316cc494ae13e6b1092191009aa363b0fc73ad2e9f7b4e531bb73084d3dbbda54e240932ec0b89b05a5fceda58a52a308091ce468dfb
-
Filesize
36B
MD5ac58c40ac9f27af1825d45f13ef645e0
SHA1d5be77cdd0d0386bb3e3dc99bdb7bdbf8127568e
SHA256fa5b14ca60eddec6fda62364d335bae26d237dd15200c4240b33d4233dacebd6
SHA5129a6deb6dd4921d3b82449eac619f404520c7d94c3482ddc16d217042222d04cd521217ffbe6de5101ede329e60ef0bee0510958b3be40b93af0ce83cbbe3e088
-
Filesize
19KB
MD538c960945cceba468ee4f1772abb99cb
SHA1c7c2d5bdc5d06a5f43c24809602d0f2d2ba8e62b
SHA256b8d90074a4efd78bcdecc27a24d4249d53b0b76134590750733d1136d9ad964e
SHA512efa6c5518308ded2af559bdf6276176be8f7067dd1a486dc7f23395435a2cfca4f40106275e38ae126b52d943fced8383f92469c734f3b721cfcc78db400e1f9
-
Filesize
40B
MD539e2fde2e9a5b8703cf65c701ac7df3d
SHA1a5abea415a9deb273e2a443a33c5576c0b1e7ab3
SHA2560f0d08e2f56c39f7a71088ed4205e62c1d35eb855b8f3bdc8e6bbd46a0ab48cd
SHA5124cc7b16debb3d54906dda488566ac5af30983c6f443552d0d7af59b09ce054e91037fc09752ca665eeda402cee9331a7f17527e273642a4f49b9fb16962123bd
-
/data/user/0/com.nuklis.artpainting/cache/org.chromium.android_webview/Code Cache/js/e06cc44686ac5311_0
Filesize548B
MD50c1a82c1669eddbefd0065d41f75d390
SHA191aaa243abdbf7da3ee731cefdd1745966a80aeb
SHA25619025a0834f2826bed5accbb15a450cd2621163245ac081124e97582cc09e338
SHA51212b2d8a0efbbc6e7e504008841c1e892b609e36e245e76c7ea100bee2f459e92478a89c75471a4cb89268d3b6a2bbc7f132a61da9f900b62ff684584a5afc18c
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.nuklis.artpainting/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize96B
MD53faaf859811cfa4991ab1f7995bbb1fb
SHA1c5ea945799ce32e4ab549effd19c1444934fe244
SHA256f2d1da20c39669d9b5246e678e049ab6d15d55db4019e32dd54415677d3b48cb
SHA51233eede35b95261d70d20e81a738fea55c46ead8498dd2792368f72e534418add895421baf7f55219f0006e8f80edd5f44fb4182bc4722b6b6cb71f136fc0688a
-
/data/user/0/com.nuklis.artpainting/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize144B
MD583f872aa2877f9a031e1b4c08b010856
SHA13172e6a628e426846fdadba49aae52c2efe0f238
SHA2566de09bdfc8fb3f0b6bcf1e982d39dc98c993453c4056160702e1ef520870fe53
SHA512f74835145046a73677907330d798932c4827188cc7965e34a9c90c2d47e6d9da55a83a8dd8fef9dd6ac49ba8e34c545eb0528c5e53bbaf54ec13e24500a3bc22
-
Filesize
12KB
MD5b7f256f95945024e733cf01ba561fe6d
SHA18dc60c91a63d64cdebe9ad91b3eed91427c5379e
SHA25652ca1580f59c2d8d107640ba5247044e8451e4edc342e1cbd07f1d1b2cd710b9
SHA5127a581ce4b01bbe209e248df85a48742db85d73c9202612a33e724a4945c3baa9666f8e44f499264686eb0b907947e0658bffa86c5dc79f295be2750e0260601b
-
Filesize
247KB
MD52896ad7d3d76719acb076170e97a3d22
SHA17ab032aa1546d8c50cd6927cb47cebf386a9d582
SHA256014825c10c3f198f71780f49460f8a74773d92c75f37a2fd1e1df8c1ca3bb0bc
SHA512c151624b18e93fbe0feac0e5f82bd71794ea0e6d84c25483593b64e7a4652368f6f233136037e13b9f1ff9ba299785b0b5a8544279dbe0e4dfc53734e566c7a6
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
144B
MD517761e43e7e06e14b2cd3f6d0f208d8d
SHA17627186c5c3f03b142386c8c09eede3fb7322980
SHA2566211696988ee0968a6e5512ba43b0ff27d961905597627b1eade4e9592019edd
SHA5123c9212a5c17e6e7bc7f78a04a236e950e5e53a5bcf0e66581881a23d2426dc9912e11928a4ac51e961f376a8a309325d9c1a7902c3a72aa5b35a02614d9b0ff7
-
Filesize
192B
MD5105b6891119f1d1b9cb3ea656cec7a26
SHA160defc57df950ef71b061a1ec4b4a6d6823827f0
SHA256f83cd4f1208a6c11f12012ccd9b1e5feadb474b2b26c46f9bd7e6459fc884ff3
SHA5125ddfd3f1c9c6b345ef7eee9074325cecae6eb7d1f10d6d8c4a2eecc9898c8a749adaed211de4f72a8ff11a58ffcf3ccffa5221b4f8d9be1ef584aa34b0ad2308
-
Filesize
88KB
MD588071e85bcd69a166751848a665e3c44
SHA1c2e6aaa4c826580174626ddfad8cdfec8a160c6c
SHA256ecf3d48ded7978e8de46066dae0c07a2f04db68c6d41fd1063749eb9efa1fa24
SHA512d04e228386774f3858ee1f49165e918fed346f9539a487fc19cdb50871866b78ac9aa94f2e5b30d0b157d8ea96bc1f0ef51344a2d2013a725f13897ed02e521f
-
Filesize
1KB
MD5ceb5455a063628e4df2aa857466d244c
SHA175982ec86ce5fc949e15339fe54499234e4700e0
SHA256b646f47c9d639282cbf7a7318a0c488c54d4e9657cfb2e31105965e203b2176a
SHA512c6a372d467ab7b33c486f2d41ab993048270d6be5493d8bf26eb1dd521b33000416d8f8e7a856e7470b9ec6e24f22dcf8b983c4581a5230bebfb1c8b3123ebbb
-
Filesize
22KB
MD50d4e0388ddad6dfab2e1d43c0c339ad0
SHA1a097d295281c4796030ad3a8d6a24cefc8ac53b3
SHA256409633ccb7463620e5f774ed0b466839f5aaa8f8005082af67bb7bbfbbf1a8b0
SHA512381e7b5b19ff133c96550e860e66e5d61ee75bf73be268d7eeffdd5200b59e293ac979a07a303eb3d2e9b4f6b20acdb0335398f0b13c4c64a48b184c8e273d3a
-
Filesize
46KB
MD525b621b14e9bdb8d3009a25ac15b2997
SHA1fab787ef17d4b1fd8ba506ac433c90933685972b
SHA256d1491805efe37e08dd402d82d7e03b74c27dd21b00963aaebf1eba373d803b56
SHA512be560e695ca2b63672381b47738c5ce9963ca1b2ad3ad42c723e464d0f48ed6d67fb1b98197f597219e8272ba0c67a7d375ee05ef7d34f665dc4d3da58b69355
-
Filesize
844B
MD5f31e821104e08ddc2e2afaf558fac542
SHA1d40668f4c691220258e9ce2d5afac5a039aa308b
SHA256289e9ebd3e31faf2cf2293aa0eb5f5293fdfc04de8c9bd6bd00b7ef587e975a6
SHA5125e730b90a0452a7e195ec1fb5cb79067c1dd383e51c12970b4714a2a41b08ec0969a9a234b5aeabf5165f84bec63ed7acda2a3e836e77d76645089679843ba07
-
Filesize
9KB
MD53c30eb296bb5eadfda95ebaa84ad9b5a
SHA1210affe08e642caad98f5b53c3e14ee52c34dcdc
SHA2567046320162f6db8670145a648c08e3c94ddb7064cf4204f7531eaca627404e27
SHA512120672861673362f1474af120001d1e2fb46c7db872e27706e1835fa584f49513d5c970b0618b0eaecd27869fd937267b030881c5e5a0e866db327e9d27f42cd
-
Filesize
15KB
MD5f2e4732bba985887330fac436cb3496c
SHA1731562c0252a55ab141ec86335f502decf6a7d88
SHA256d89523eb3b0c6e611b1e041792265e8f67b921d58032ee81afe262d8b99a07ca
SHA512024ac60af79d633bac8d10ef2797e9cfa510602f58f9482920b9dc58c8a5f464d9509b4e5e587f39784fc440c903eaae05aaefe214832055cad889754d043b79
-
Filesize
8KB
MD5b6ca8b30661a7844ed292db75a29a953
SHA18e0d397ab1f2ced1f143829084c3f53333743bdd
SHA25663a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb
SHA512d21ce3adf13d61369708ea000438f626973f20b08ca05a744c1cccb2d5e7c264a8af9c3ebd18a7a6a464d38e1c64146f8e881d29d71a0484dd94212315f6dceb
-
Filesize
1KB
MD5b0306acdf716b11f1e44ac3d68aac96b
SHA194f8ee36e916d158af787b59ecfafcde9bb84ec2
SHA256253e93942b1b9a6e33d399cb56819460c3f7d93bba279549a304dc44471a162d
SHA51202f7214a5d0f6bddf719d74cfb7b794566395b30f37b2bef65fb6accf7ab30706a7a8ae3e4464764d5029b4afd71765fb21e4271162a3bdb2fee1b379bb7f588
-
Filesize
16B
MD54ae71336e44bf9bf79d2752e234818a5
SHA1e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA5120b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
-
Filesize
217KB
MD542cb4396e6de04c14cced218db8c8873
SHA124c7fedaa39937315cf39a239947d484864b8ab0
SHA2562241a86ffdca76e70cf36332f98fdb57f6a292ba73f6cd25793bbf8ae0e6cf1e
SHA51260e0b78f81cd288be04337490fc081026d2bbf77cf6814ff12a3d5413ae491bbe3f170ac76915dd3c5a3c4e12984bd849c454d7607ed10c1f9f20731b9a92903
-
/data/user/0/com.nuklis.artpainting/oat/x86_64/[email protected]
Filesize163B
MD5242fd5e163e734a17f430352ec3c32d5
SHA1ac3d6b6fa2943d09ac302e97818ca9b5aed3e19a
SHA25638a68720d45ae81d5e86f43b6e44276ecf5b55ffa6226b14d0e0d24055d874a3
SHA5122234129f456012b07d7844eae38ea9dc47efdc98288f9e2ee1a02d8bb0ca4bcd04108ac0bc3d99f7ae4e701be89627e3164b43f7a563810ae3c2f5a60eb26fc0
-
Filesize
127B
MD56ef709b8536878951e87c29a1518fc2b
SHA124376c70b00152501b3d98df61fa7db435339172
SHA25610b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA51296547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9
-
Filesize
75KB
MD53c223094a23dbd76501ec5bfe02a8c51
SHA1165fd5f36108a7607868e5c002e638938157828b
SHA2561fc0177b909092f15bfc6c082514e321c82699545a48886f56b2e6f98585db3a
SHA5121aa75614816c5aceec921eeeff7a13c92b5ff8efc36fea4bb461213ff52e0ee23439e8f42f070409e82fa1b5ae7d6efe9956b9a470a9882164e1126685adb9e3
-
Filesize
5KB
MD5cf11925fbd5e7de3cc30bff793d2d362
SHA12f10f00a4914ecb9ef31842f4a22041948570aab
SHA25613afafb20e8cdc06b1b747665e024bce9fd3efdf9a5debb7a853b61ef4bf540a
SHA5126737dbe5a2f5c72f7d4fab9c04dc52756b917303cd909aa20be9cdd268c8d08187f5a2b7eaebf8f6af1024617c15821d90fbef927bf980eb6acf7e62713a2f60