Overview

overview

10

Static

static

7

Paint Art_1.3.apk

android-10-x64

7

Paint Art_1.3.apk

android-11-x64

7

Paint Art_1.3.apk

android-9-x86

10

Analysis

  • max time kernel
    104101s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    12/12/2022, 12:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Paint Art_1.3.apk
  • Size 4.1MB
  • Sample221212-p7rcdsbd39
  • SHA256 0f41adb9d470c2450c2987c1c6b3a2ddcf8bcc47fad7a54ee4ec064afd0b8a3e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
jokerevasioninfostealerransomwaretrojan

Malware Config

Extracted

Family

  • joker

C2

  • http://thoroughly.oss-ap-southeast-5.aliyuncs.com/artpainting

  • Grant permission to use all features

  • https://cxjus.oss-ap-southeast-1.aliyuncs.com/af2

  • https://cxjus.oss-ap-southeast-1.aliyuncs.com/fbhx

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.nuklis.artpainting
    1⤵
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4096

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cookies
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Cookies
        • Size 64KB
        • SHA256 64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cookies-journal
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 5b98a53d8fe0d441508a94b0520abde5977d54c964e1841c06c48e6ad3c74617
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Web Data
        • Size 104KB
        • SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 ceb1d9665e3cd89cfd17297f02e16de5f1a08fd6be5b704339c1f2ac0bc7591f
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.nuklis.artpainting/app_webview/metrics_guid
        • Size 36B
        • SHA256 0c6097bf055c74c75b36d680c3c74992ed7ec80c2687a2d48d87c04bf0a6743b
        • MD5 SHA1 SHA512
        Submit Download

        PAINT_ART.DB
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB
        • Size 32KB
        • SHA256 23f8db729e1b9a205e42e197a37b7255d62492e3642e00476ef77c135d57b3b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PAINT_ART.DB-journal
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-journal
        • Size 524B
        • SHA256 3dd1e68eff53febd28107b991a55665e996a8ff88f40f8c767754b20f2faa8ad
        • MD5 SHA1 SHA512
        Submit Download

        PAINT_ART.DB-shm
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        PAINT_ART.DB-shm
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        PAINT_ART.DB-shm
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        PAINT_ART.DB-wal
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-wal
        • Size 40KB
        • SHA256 9d9a62ea20b357f9bb85d3c56c034974149090dd8d2071570921dd3ce95e3e15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ionsxg
        • Path /data/user/0/com.nuklis.artpainting/files/ionsxg
        • Size 22KB
        • SHA256 409633ccb7463620e5f774ed0b466839f5aaa8f8005082af67bb7bbfbbf1a8b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ionsxg
        • Path /data/user/0/com.nuklis.artpainting/files/ionsxg
        • Size 46KB
        • SHA256 d1491805efe37e08dd402d82d7e03b74c27dd21b00963aaebf1eba373d803b56
        • MD5 SHA1 SHA512 SSDEEP
        Download

        layer_1_1670846340151.png
        • Path /data/user/0/com.nuklis.artpainting/files/temp/layer_1_1670846340151.png
        • Size 831B
        • SHA256 ee2355504e7096f63c4607e59a9081be9ab6ee55dbe4cda997e6ad128160df11
        • MD5 SHA1 SHA512
        Submit Download

        vitality
        • Path /data/user/0/com.nuklis.artpainting/files/vitality
        • Size 9KB
        • SHA256 7046320162f6db8670145a648c08e3c94ddb7064cf4204f7531eaca627404e27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vitality
        • Path /data/user/0/com.nuklis.artpainting/files/vitality
        • Size 15KB
        • SHA256 d89523eb3b0c6e611b1e041792265e8f67b921d58032ee81afe262d8b99a07ca
        • MD5 SHA1 SHA512 SSDEEP
        Download

        androidx.work.workdb
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-journal
        • Size 524B
        • SHA256 9860d31b016474f8634d2ca24086d228ba762f7e44693ece17e0c3a848cae1b6
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 579b431a4b35f20a02a82c80e16afb17b4d00c1522e7c19b817cf0643205409c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.nuklis.artpainting/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
        • MD5 SHA1 SHA512
        Submit Download

        -1451633082
        • Path /storage/emulated/0/Android/data/com.nuklis.artpainting/files/-1451633082
        • Size 75KB
        • SHA256 6a3f734a3ba7a07647793f48d8e8d6981e2caddab5aa2994f6f3dd3d091ae529
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1463903199
        • Path /storage/emulated/0/Android/data/com.nuklis.artpainting/files/1463903199
        • Size 5KB
        • SHA256 13afafb20e8cdc06b1b747665e024bce9fd3efdf9a5debb7a853b61ef4bf540a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Anonymous-DexFile@0xdf602000-0xdf60364c
        • Path Anonymous-DexFile@0xdf602000-0xdf60364c
        • Size 5KB
        • SHA256 13afafb20e8cdc06b1b747665e024bce9fd3efdf9a5debb7a853b61ef4bf540a
        • MD5 SHA1 SHA512 SSDEEP
        Download