Analysis
-
max time kernel
302082s -
max time network
17s -
platform
android_x64 -
resource
android-x64-20220823-en -
resource tags
androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system -
submitted
14-12-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
Smart Drawing Art.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Smart Drawing Art.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
Smart Drawing Art.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
Smart Drawing Art.apk
-
Size
5.9MB
-
MD5
5d3d5cf12ab3a1aa4acae745f0623613
-
SHA1
87e5ec30741d64cac43351b429fc2dc0b01ae2df
-
SHA256
909a05f9f7ac3c187afac226376ca0e85a64592dcf9d2ba2d5567ce021755732
-
SHA512
0a57d30de07d92c39a88b03c35185bbd5d66a204f851e85f160add33c136bf9ad6c9270f83f98f2aa74be3ad69aaa37dcfb932b029a9e6c3c3b3015fe07a8f68
-
SSDEEP
98304:OIWWW5Q+jIIvbjmrVfYCqbQ2gG+YaOs4urV/GvtprR6825eXderF3kjV/tTosKna:OIWW83kIvIFYM2x+Yatp/GvrR68GI/t1
Malware Config
Extracted
joker
http://appear.oss-eu-central-1.aliyuncs.com/medib
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.smart.meid.draw/[email protected] 4766 com.smart.meid.draw /data/user/0/com.smart.meid.draw/files/showed 4766 com.smart.meid.draw -
Reads information about phone network operator.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.smart.meid.draw/[email protected]
Filesize5KB
MD54218ebb2cacb38f9f638285c591029b5
SHA11a6f40f2faa3334890d0f03903d02d935a44206f
SHA2562dd6d0fd030659a154b885d2c4e1616c287c972fa2feb29a6678d3de9762661e
SHA5127d8e490ab68d933aba62e3ca1d13928671a39d072adb1d901e4d06d317986de58e4d3833aefbc1e71182052a688e0ca7a4cbf014c42e76057171e9bc7ff603f3
-
Filesize
112KB
MD5b663831f8cc130493476d94f2d7a5330
SHA1043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16
-
Filesize
1KB
MD5df831dbc2ed3d251adafc18bd0bee952
SHA14eafce00078c1c7dc0882d74851b9ba3d878f314
SHA2568a5b9df7c6202e91f051929c53db0f11c113bb584c5c7c1f170fd6a92ef411ce
SHA512cac634ff5b98c6d680fa8407fb0977161842f5a992a24f4e6ee75b513dd5e0fdd226da49614598ceca5ca7f789b53c2cff46d42fbf705313f6ba987cf652eb95
-
Filesize
36B
MD546002b4f15566b40924dfffdb9149df5
SHA19608dd43130772b1ee0bbbd96e979dc4f6540fba
SHA256a67dc50ec7b6f9bfd53d26f1586474678dd90ac3e4975819232f0b4fb0cc7df4
SHA512f73fcfb64f53b16df02f82fbdb64f9e52565a9159730b41b4f370d7bbbdecd710fb5d0d5322126f4ccb1fe3d4b344d5e0916031385fb620c1b60a9d1ca9cac09
-
Filesize
40B
MD54b34a6e146a0a5851ca4001f4bc16afc
SHA123edda185928bd685c206de1ad23fc6e220e3617
SHA256f40e7c1ca5377a6294683a7e37c41601e6f4306c7f5ba83b62fdbb01c5dc7ff5
SHA51268b9b2a719251cc10a46934ecfadb3bbf9cb3e763d45bd07737ed3418f0c1a083b9b724b21a2bde4e8f56e71d3678af0ca9f591fcce1289e59f86309f5821cac
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.smart.meid.draw/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize96B
MD5f1187598dd809765fb7404d050b6eb7f
SHA1a2a4be2fadf93febbc92833af33f8e5227192f45
SHA2560a14c776eaada0d8aafd41e6f96fe8fce7406755e39e9aaab98acfbc976f83a5
SHA5129256577c616d79e9ca618594c8711c42ad6f298103c252ad01dcdccb1a8537ae9790fb25d019ed51e6576dd9b4074a0f5cb1c4fa2a0fa1622113bcfd5c390db1
-
Filesize
280KB
MD5211f8b8b3da85d398047ad1f300e1ca9
SHA1346a977901873cd0869d3328323668311aa58ec4
SHA2565e15169dcebe53a0898c587e42b25714cb75d5dae22373de60d062ab647b6ff3
SHA51206998ab200bb65ca02858feb77e13d3ca54cf758062b27c061ce984c7178aa9e91607cfac9ad9e68936d683d1f477f8394d438cc1b98a9c91316b72b26926577
-
Filesize
1KB
MD57cc78e1949eb3bfc6f5b440a6de8274b
SHA15bbd4df889edb59a1b8b9c516707daad23f9e8a0
SHA2569f9d1c173961ae2446c16a5743669da93aee91fb2e18045c656595a8d061eaf5
SHA512dfc34564dd2b2bbd61bf4756da46c3837d3d36229b5e42bc07cbb1695fcc13ea94a3d5c39d84bea673d0fb656920e54db395f147ac42d7a9aabbe0e3efa6abb0
-
Filesize
352KB
MD5e90612bdf90bb96768c55ca74b51bff3
SHA1e09714a20c0065225ec5d77fd676ceed5103ffda
SHA256757bfc5bebb8b6c4ad90c4f9bae5e89801e2d1e2602085e331fb6844f327d49a
SHA512e8afd9e1323b2880f7dc4bdfd438b68062d0c191951504ca6869b7bf6c4415891153d43e5656fb575c7b413458842dbbfe01ab298bb0fd07ed2c4148f1794b8c
-
Filesize
1KB
MD55fa8c3cd832f86ca206ad296a4572de5
SHA16b99608c318905ec0b019b5ad2ebb04b590ed029
SHA256530a480e6bd507c116f3061f162ec5877d56790b4f6dc236ef2891c0ea43dcc3
SHA512d3e993bde7faae5ce1db91a61deb5e8a7e309fe1971d4006b12c40affb6c93b503be1f7d4bd24ec46ec92a655b32d2aabe74c40e5fd77bc59997da35ab0bc949
-
Filesize
88KB
MD57bd7e08b7c157fb7a04f9701b6965b65
SHA119ed78cffffd879509071b091ba60776c18e8d97
SHA256c3aa0e8a52b6dcae0f988502bb3887f94c13148a8f36c3fcf5036c7c99afbdbc
SHA512a668c141cd4d48396e9d67e79ec1036a8ad4498293e0f16d108e8c4d842f76714f561bbe440a3a5dbcfb6b7ade257ffed7fa07c56566c8ea938589c61943d4cb
-
Filesize
1KB
MD5ace0b7f1ca84413ead95a323e15916d7
SHA1b83ed4a5a39a92c19fbc0efc7bd04168610a4800
SHA256ce1f0ba08f8f0db57539bee174cd964e1566bad50eefa4fe549e5d638f4b5380
SHA51214a69677b5706b4c63f4a918275751da79963d37f07edcded6b6a376e84ee1ee355b41c647df4564530059c1042e5f97f686c802ca7f08b65632f58e92fc5509
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/com.crashlytics.settings.json
Filesize721B
MD5e4e28a4d9fcbeefdb9df0e0b54543a94
SHA1b28b018463313479ffa4b054712b9a3dc02615fa
SHA256375accd2c76710d371d8ce5be295b1f775b9befed36a5885397b0a36db290b7d
SHA5124a27afdbcfe4d3b7671b7e0387b71c3689d51dea915f2fb19bc412abf4a263634b45abdf28f5c4ca37f38422d5e3faaeb02350423612ea31f8831a57c56f7c41
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/open-sessions/639A1D0400480001129E548EDA36B56C/event0000000000_
Filesize40KB
MD5964d2b5c89908b7b458b0d48c8a6f20c
SHA1863c0f63d45d2af031ff1051260b2ad937a4b5eb
SHA256a1a3dc9fe47589747cadde7bfe3b773758420aae4b039f7109a1a9427092c456
SHA5122fcbe4ee6cfe1c5ab70c23deb14a111e4a43debdc10881c246614f155454c0db3596a11613ecc774346d1461f817658e36bd3c9b0ce222db576ca59ea1ac4484
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/open-sessions/639A1D0400480001129E548EDA36B56C/report
Filesize731B
MD5e92f1c88f1760f980bb691ebb681ee19
SHA1bb2fc74a82332b7fc4e3ff47e3c9c1ba7c313025
SHA256a7f87279546f99f4aaecf008ffd215f5216b673262cfd81d43aba0910ee1627b
SHA5127f3dad9035e533854d2922a2d6fd4c932ead69140f90e4ae30063d5ba9679a56635fb8427222945b34d9508161a693926573adb2dae877cfb375e1af1d7d94dc
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/open-sessions/639A1D0400480001129E548EDA36B56C/userlog.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/open-sessions/639A1D07022D0002129E548EDA36B56C/report
Filesize731B
MD5d310d4d9fc205b21a88e2d05eafeb48e
SHA18aa6da966b02bcf1bf9b2093c2b4c1e078b12911
SHA25639b7e3b89de8f879272cf6ff257d4986586a75c1907b3c8bf66f2176d4560cee
SHA512dbf6f1676592ad02512f4f7572aefe5f9b8dfb6730429604995a1cdb889328c5e4c2518aa236956262ecf5876a1cb7941102d8443f8538248b2297d55eda8518
-
/data/user/0/com.smart.meid.draw/files/.com.google.firebase.crashlytics.files.v1/priority-reports/639A1D0400480001129E548EDA36B56C
Filesize41KB
MD5f25ab2753d296cf9523f2e931c996b06
SHA1e4ec7e29074d1112f22ecd2ef9468c34184731f6
SHA256ae166f9fb164c55e3e134f0237587ab9320938bb0c8d8e0f310f25da63d03f63
SHA51242b7f54ad33f8485563c8c1f74827d9749bbf01f55266e6b08083c94cd35f6a382191c7af2288107e412bc7cb625581b4246372d8ce351edab46b5a37f05263b
-
Filesize
9KB
MD5e1386b3f22b6273cdf308838dedac997
SHA181f715ccfd7dc21ff128778c1c6075974154096e
SHA256a5214d8c7b561714ca0d82e369e12f67a7bc5ec7ba29eaf993ac95a43d490c0b
SHA512f4640de8cb6fff6b2b3c8f3570c27599c836ded4337f7b97a09898f4db8b622f6ff2075e852c2dcd3dada9310250ebddefeb5770c212df5c70387e325b1faa01
-
Filesize
16KB
MD59ed2cf72815ba79edf0a6e1f28d05e84
SHA13b4fe17a663d415d763ba1729e15f12aab5f9623
SHA2564e047c886abcdf7a4d307257516d5a09e4ced0cd43a95e7f144bcafcedb90d1e
SHA5128311b103d18783261cafe1787d34a606bdb89a63d15a29dffc6058866fd5c04db472ae1be18ad7946b180f251de90e94e009a7eb88d73900f4193f62732a77ce
-
Filesize
8KB
MD5b6ca8b30661a7844ed292db75a29a953
SHA18e0d397ab1f2ced1f143829084c3f53333743bdd
SHA25663a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb
SHA512d21ce3adf13d61369708ea000438f626973f20b08ca05a744c1cccb2d5e7c264a8af9c3ebd18a7a6a464d38e1c64146f8e881d29d71a0484dd94212315f6dceb
-
Filesize
1KB
MD5c4971d59bee00c722e87ee8efe07331c
SHA126140890541489f2eee0a6b9feeec117ee98d722
SHA2565eafb41b3284ce94c5befddcb3214b96444ac0bcd59f26899c605002cc07b726
SHA512ffee7d620d9db31c1f519660bdd7f2f0daa8fcd439d4ad5beb69535f55973ce9c83556a3bd53bcfa1921bb94fd800552d7f2a257fe20785a9dceeb378e1ef275
-
Filesize
16B
MD54ae71336e44bf9bf79d2752e234818a5
SHA1e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA5120b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
-
Filesize
217KB
MD5b5f2d28cd2fe8f71de9103df9b928dd4
SHA1eac57d8d66ac793592faf827ee265aea56972d24
SHA2569cf9b1fd1dcefb72e5565f4d9c225982380bfc8a5da6ea589673fac4fa8a6404
SHA5129d015c249a17240132c9708a2bef6b5b17694db7058370ccd15fae3ec580aa3194d406526aca6a1efb9ca5c05f78307b0a6e0e5343d253fcd53b92df6f314da0
-
/data/user/0/com.smart.meid.draw/oat/x86_64/[email protected]
Filesize248B
MD5bb7e6586b6f2db3d57875692eb2c1eb3
SHA1f7f9999dd4b340c3e21a42a6f67f043e03c20fc3
SHA25695dd28fee9fddf7a4f2c2ad1c84c0e6e2b71710a4bfd765ebe06891094e46631
SHA512824ac8ef63fe66434ca06cf5745dedde1359bb6cbf17fcacc0d4802caee84284115c16629cd3a1e5f5d675f5b619cc5872d88f92565ddd1dbdfad93fe3935957
-
/data/user/0/com.smart.meid.draw/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToxMTUzMDg1MjUwNzA6YW5kcm9pZDoxOGNmYjQ2MjBjMjc4ZDZi.xml
Filesize520B
MD5fbb4eefbc8cb5eb0ea8b1d6a37ccd088
SHA1e725ed964bbd49b5e26bfa8c3c69793cc4f44c92
SHA2563d5bf737456028381007c65bf82ce329f04aea4098d61a64c9981c956243c935
SHA512105fc6bbd0c0e9e7f083caf4c0912a30495a4629e4d8dd2f0dde19cbcddbf00d83ef21b12aca0e99e87aded7403bce658ba64b3d1aea2442d475cb1f6c9b5a75
-
/data/user/0/com.smart.meid.draw/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToxMTUzMDg1MjUwNzA6YW5kcm9pZDoxOGNmYjQ2MjBjMjc4ZDZi.xml
Filesize124B
MD51572db3132da29f395eb83595ef79a52
SHA11f2a535e9ac52eca88b01b3b7e0e13b28c7b3115
SHA256185f86326aad9d1ada950370b66fefbd7cc3c89855e686e5308f5fb6ac99fe92
SHA512391a0c40054ed3ed0f65b4949392db056d3fdf413a0bd769ec68e6a02c7193ab2d20873c6724233af605a7c4c806098ab87e4d2fb15dd2fb2b7fde31e2a5765f
-
Filesize
127B
MD56ef709b8536878951e87c29a1518fc2b
SHA124376c70b00152501b3d98df61fa7db435339172
SHA25610b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA51296547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9
-
Filesize
122B
MD5250b4caeba60ddf53228405750ba66ca
SHA1422ab714feb34e9f3b4f1cbe669887bcd581ddb1
SHA2562478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e
SHA512373750c29942fef90281109b6025c398d0f4ac62b58a984a3651d09f8c016440bc40f6bd84fb6d40acf8e48a553d4c1d22e01a95c40a41567c079ba9a338afdb
-
Filesize
447B
MD5729f38268a6e6073a7807174820529f9
SHA13b70da9cc52ab4f9b24a86a0c929025e8cc4ec52
SHA2564e71fdae49bbf8a8548f7a8bc50888ef4edbbad399dff964c37e60fd97584afd
SHA512af22faf24fb61a79a1a6b83e6dd754bb460e7fe01cda8a598c89d728e0456cace7a3ab7eef79de9e4425bf9838104c4779237e2851bdb43ef18df361e4af4b35
-
Filesize
610B
MD513325c5f9508a5512de4863d6bc963a3
SHA1d21048e7433c09fbe0324126708796e83c1d8a48
SHA256ef89da545d54682369282329c00b8b271d70845c9db43ca55b62f2ffd02c7798
SHA512c1091d93fe06860fa69ab7b92f1e22d67b0bcdf6954bab305d6a0ab877d126eff0acb23f406ed7665c2f047ec50fee4404e619bd729610cd8ca0b10c64fc62e9
-
Filesize
611B
MD53678ef389d2476e6827796acb349f5e1
SHA11304a4e0ace413464b9a03841829a44ce947f2a8
SHA256154e33c99fc85d8a96720cdb690a2fcb6170346d697c120e903df0b23a26a8b1
SHA512f4731f74b8f5f96443eb5d1fed94376f407a096350f1bd8a18784291e80ca6661f4cd49ac56bc9d2edf51b51851712d4a9f319d1d4e1cb6781891ce398016d1a
-
Filesize
861B
MD5ca59991b3a15d0946e812034c54587c2
SHA1bf367b7b877af928572222b69a1dd37dcc778c83
SHA256a38d3adfbb458c85d684dbf529699a9691f9674da8e124f4f75ccd27f9cbfa91
SHA5123172f07beb7fb838d6802bc64ea78517968e0bdf5c70c44cf9639cf2b8a8bfb2d30fd000d5dd5587d31e935b3dba267e14a9a563ab2d1b097df25a2b6ae532a0
-
Filesize
915B
MD5c6a834e75d1de8af3063736a5e119d12
SHA1d6ea120cf15cfb0ae9a0338a9e5205889cca77f1
SHA2567f2393616023df2e93de560c765283614e81c03eeb9137a5d73c40bbcffd1a0c
SHA51253126ecb8bc67a4dbbf501709aff85b73cf2ec592c56f45a59720f56422d8c8feaf37a8e3e556335934451c561a7080cc8416451ec90e035491aa13693c1d8e3
-
Filesize
333B
MD524a0b80757568b6aeafff68a9a8702ff
SHA159f0f054aad6010be1981520fae679dda8a34636
SHA256e9992f4a14cc19b861ce40fc585c1b138391d4870572826822570d30d01f94cd
SHA5127eecf52f6124a634b124af0de53fca65cbb5a9d4e8b76c6b7cbcbf0eb4168f7cdadca26f2f3fa36284728689cebfd41fcda6abedd869a4c7c0f526607642738c
-
Filesize
235B
MD5859e85eb4361404777c398e3f846dad6
SHA16dae39448747b5b330d1598494e1b819fe70ba4f
SHA256d8ee55a5c45c134356bf913329de5a6b1f8388409560cc4fc63712c1efa1aa01
SHA512d1c4660f593bedf426b2464952fcda9f66147cd114d30c829565c7311acbfee897fe1d6ba431a45e7b2c5d8e65175edf5921f95b8bbda2de9674237f8e1811e2