General

  • Target

    Camera Voice Translatorr_2.0.apk

  • Size

    10.1MB

  • Sample

    221219-rwzwhafc36

  • MD5

    1c78f60730eb447e050ab95084638f81

  • SHA1

    6f7f3abc83523968cb6282556d4d28193ae58baf

  • SHA256

    f8e2f404df8bb8129143eda2bb244f6fa5dc50077bedd1469cd68b5c498b520f

  • SHA512

    57516e1e7035ab0b0be4a294cfcc6e8fdca43a2518289fd3dfc8e49c9d723fb5bd3787b4e03bb618c3989b089ec51b0b8526df600538bc445f01f1ac1e297897

  • SSDEEP

    196608:gMIpCR8PAYmJLxA6MIB2xVZ1H8WZygzbUHWbV73CE8qGR64y:gM4CUAbeXIBu1Hlb3bJ3CCJ

Malware Config

Extracted

Family

joker

C2

https://kbnt.oss-ap-southeast-1.aliyuncs.com/af2

https://kbnt.oss-ap-southeast-1.aliyuncs.com/fbhx

Targets

    • Target

      Camera Voice Translatorr_2.0.apk

    • Size

      10.1MB

    • MD5

      1c78f60730eb447e050ab95084638f81

    • SHA1

      6f7f3abc83523968cb6282556d4d28193ae58baf

    • SHA256

      f8e2f404df8bb8129143eda2bb244f6fa5dc50077bedd1469cd68b5c498b520f

    • SHA512

      57516e1e7035ab0b0be4a294cfcc6e8fdca43a2518289fd3dfc8e49c9d723fb5bd3787b4e03bb618c3989b089ec51b0b8526df600538bc445f01f1ac1e297897

    • SSDEEP

      196608:gMIpCR8PAYmJLxA6MIB2xVZ1H8WZygzbUHWbV73CE8qGR64y:gM4CUAbeXIBu1Hlb3bJ3CCJ

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Acquires the wake lock.

    • Checks Android system properties for emulator presence.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks