General

  • Target

    HappySMS_31.0_apkcombo.com.apk

  • Size

    34.3MB

  • Sample

    221228-n46r8sdd7z

  • MD5

    95d9b2ee82005cd6c8437b46e99c2568

  • SHA1

    57f434cc04a6445bc60b0b6431fbc51eb1d339f6

  • SHA256

    0c432397992f149521df05ff2184c3e32adabbc403e2b46d3ecf4f91d4640081

  • SHA512

    c220b48c1620124655e03672d15491163bf68d6f9b19de4b7b1ba38ebe7650a17d418113c239c712f96a54c83ac7cd0bbd46d95c8a51a629c17ff5c713de20e8

  • SSDEEP

    786432:UPSv07Bku4Jfn6REbfwwC6R/gftk0PB/YqlKBSUnvmspJQ/:UPSs72Jf6IwwCLf2WB/Yqlgbuz

Malware Config

Extracted

Family

joker

C2

https://kbnt.oss-ap-southeast-1.aliyuncs.com/af2

https://kbnt.oss-ap-southeast-1.aliyuncs.com/fbhx

Targets

    • Target

      HappySMS_31.0_apkcombo.com.apk

    • Size

      34.3MB

    • MD5

      95d9b2ee82005cd6c8437b46e99c2568

    • SHA1

      57f434cc04a6445bc60b0b6431fbc51eb1d339f6

    • SHA256

      0c432397992f149521df05ff2184c3e32adabbc403e2b46d3ecf4f91d4640081

    • SHA512

      c220b48c1620124655e03672d15491163bf68d6f9b19de4b7b1ba38ebe7650a17d418113c239c712f96a54c83ac7cd0bbd46d95c8a51a629c17ff5c713de20e8

    • SSDEEP

      786432:UPSv07Bku4Jfn6REbfwwC6R/gftk0PB/YqlKBSUnvmspJQ/:UPSs72Jf6IwwCLf2WB/Yqlgbuz

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks